dingtalk-cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:32 AM UTC
• Version: 1.0.0

Overview

This DingTalk document-management skill is clear about its purpose, but it delegates sensitive and destructive actions to an unpinned external CLI and tells agents to bypass destructive-command prompts.

Review this before installing if it will touch real DingTalk workspaces. Install the CLI in an isolated environment, pin and review the package version, use least-privilege DingTalk credentials, and require explicit confirmation before overwrite, delete, or member-change commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-20
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

pip install dingtalk-cli

Technical Analysis

The Skill instructs the agent to install dingtalk-cli without specifying an exact version or verifying the package's integrity. Consequently, pip resolves whichever release is currently available from the configured package index. The installed package's source code is not included in this project, so its behavior cannot be verified as part of this audit.

This CLI is subsequently trusted to process DingTalk application keys, application secrets, operator identities, local document content, and privileged API operations. A compromised package-index account, malicious replacement package, dependency-confusion condition, or unexpectedly modified release could therefore introduce arbitrary code into the agent's environment.

Attack Path

1. An attacker compromises the package, its publishing account, or a package source selected by the local pip configuration.
2. The attacker publishes a malicious release under the expected package name.
3. An agent follows the Skill instructions and executes pip install dingtalk-cli without a version or hash constraint.
4. pip downloads and installs the attacker-controlled release.
5. The malicious package executes during installation or when the CLI is invoked.
6. It accesses resources available to the current user, potentially including the DingTalk credentials and configuration created by the documented authentication workflow.
7. It may exfiltrate credentials, manipulate DingTalk documents or membership through authorized APIs, or modify other files accessible to the agent account.

Impact Assessment

Successful exploitation permits code execution with the privileges of the user or agent running pip and the CLI. The reachable scope includes user-accessible local files, ...[truncated 472 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, for example dingtalk-cli==X.Y.Z.
2. Record cryptographic hashes in a requirements or lock file and install with pip --require-hashes.
3. Explicitly configure and document a trusted package index rather than relying on ambient pip configuration.
4. Review the selected release's source code, transitive dependencies, release provenance, and maintainer identity before deployment.
5. Prefer vendoring or distributing the audited implementation with the Skill when practical.
6. Install and execute the CLI in an isolated virtual environment or sandbox under a non-privileged account.
7. Grant the DingTalk application and operator identity only the minimum permissions needed for the requested operation.
8. Keep secrets outside the project and restrict filesystem permissions on the configuration directory and credential file.
9. Add automated dependency scanning and controlled update review so package upgrades cannot silently change executable behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Yes, this is a mismatch. The description claims a concrete DingTalk document and knowledge-base skill with broad operational capabilities via a local CLI, but the provided code does not implement any of that. It is effectively an empty module export definition only. This is a materially different actual behavior: the code has no meaningful functionality at all, so the declared purpose is not represented by the supplied code chunk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly documents destructive operations such as overwriting and deleting documents, but gives no safety guidance about confirmation, scoping, backups, or irreversible data loss. In an agent-execution context, this increases the chance that an automated system will perform harmful actions on real DingTalk content with valid credentials.

Content

No source excerpt is available for this finding.