Security audit

dingtalk mailbox

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it gives an assistant access to read and send DingTalk email while storing a sensitive access URL locally and without clear user confirmation guidance.

Review this skill before installing. Use it only with a mailbox token whose permissions are limited and revocable, protect ~/.mcporter/mcporter.json as a secret, verify the mcporter package source/version, and require manual review of recipients, subject, and body before any email is sent.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned Global npm Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:41
Finding: Token-Bearing MCP Endpoint Stored in a Plain Local Configuration File
Content: View full analysis
" --config ~/.mcporter/mcporter.json ``` ### Technical Analysis The documented workflow obtains the Streamable HTTP URL from the DingTalk mailbox MCP token configuration and persists it in `~/.mcporter/mcporter.json`. Such an endpoint may function as a bearer credential or contain credential material needed to access the mailbox MCP service. The instructions do not require restrictive file permissions, secret-manager storage, log redaction, or credential rotation. If the configuration inherits permissive permissions or is copied into backups, support bundles, shell transcripts, or shared home directories, another party could obtain the endpoint and attempt to invoke the exposed mailbox operations. ### Attack Path 1. A user obtains the DingTalk mailbox MCP URL and runs the documented configuration command. 2. The URL is persisted in `~/.mcporter/mcporter.json`. 3. A local user, compromised process, exposed backup, or accidentally shared configuration gains read access to that file. 4. The attacker extracts the Streamable HTTP URL. 5. The attacker configures a compatible MCP client using the disclosed endpoint. 6. Subject to server-side authorization and token validity, the attacker invokes mailbox enumeration, search, message retrieval, or email-sending operations. ### Impact Assessment Exposure may allow unauthorized use of the mailbox capabilities associated with the endpoint. The documented capabilities include listing available mailboxes, searching messages, retrieving complete email bodies, and sending email as an available mailbox account. This could result in disclosure of confidential correspondence, impersonation through outbound email, phishing, or misuse of organizational communications ...[truncated 102 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents searching mailbox contents and retrieving full email bodies, including sensitive message content, without any privacy or data-handling warning. In an AI assistant setting, this can normalize broad access to confidential communications and increase the chance of over-collection, unauthorized summarization, or exposure of private data to downstream systems or users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes outbound email-sending capability and even provides batch-sending examples, but does not warn that using the tool transmits data to external recipients and can cause irreversible actions. In an agent context, this increases the risk of unintended disclosure, spam, social engineering, or unauthorized communications if the assistant sends mail without explicit user confirmation.
Content: No source excerpt is available for this finding.