dingtalk mailbox

• Outcome: Review
• Latest audit: Sep 15, 2026 · 2:06 AM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned, but it gives an assistant access to read and send DingTalk email while storing a sensitive access URL locally and without clear user confirmation guidance.

Review this skill before installing. Use it only with a mailbox token whose permissions are limited and revocable, protect ~/.mcporter/mcporter.json as a secret, verify the mcporter package source/version, and require manual review of recipients, subject, and body before any email is sent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22
• Finding: Unpinned Global npm Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 22 **Vulnerability Type**: Supply-chain exposure through an unpinned globally installed dependency **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g mcporter ``` ### Technical Analysis The installation instruction retrieves and installs the latest available `mcporter` package without specifying an audited version or verifying package integrity. npm installations may execute package lifecycle scripts. The global installation scope also increases the potential effect compared with a project-local dependency. The project does not provide a lockfile, integrity hash, verified package version, or explicit trusted registry. Consequently, the code installed by this instruction may change after the Skill has been audited. Exploitation would require compromise of the referenced package, its publishing account, or the configured npm registry; the audited file does not establish that the current package is malicious. ### Attack Path 1. An attacker compromises the package publication process, publishing account, or npm registry used by the victim. 2. The attacker publishes a malicious package release under the expected package name. 3. A user follows the documented `npm install -g mcporter` instruction. 4. npm retrieves the attacker-controlled latest release. 5. Malicious package code or lifecycle scripts execute with the privileges of the user running npm. 6. The installed global command can subsequently intercept mailbox configuration and data processed through it. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the invoking user. Depending on that user's access, the attacker could read or modify user files, access locally available credentials, tamper with globally installed tooling, and capture DingTalk mailbox endpoint credentials or mailbox content handled by the tool. This instruction does not itself grant root privileges; s ...[truncated 91 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `mcporter` to a specific, reviewed version rather than installing the latest release. - Verify the package's official publisher, registry source, and provenance before installation. - Use npm integrity verification and retain a lockfile or equivalent reviewed dependency manifest where possible. - Prefer a project-local installation over a global installation to reduce scope. - Disable lifecycle scripts during installation when they are unnecessary, then explicitly review any required scripts. - Document the expected package version and a controlled upgrade-review procedure. - Avoid running the installation command with `sudo` or another elevated account. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41
• Finding: Token-Bearing MCP Endpoint Stored in a Plain Local Configuration File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 41 **Vulnerability Type**: Insecure storage of a sensitive service endpoint **Risk Level**: Medium ### Vulnerable Code ```bash mcporter config add dingtalk-mailbox --url "<StreamableHttp URL>" --config ~/.mcporter/mcporter.json ``` ### Technical Analysis The documented workflow obtains the Streamable HTTP URL from the DingTalk mailbox MCP token configuration and persists it in `~/.mcporter/mcporter.json`. Such an endpoint may function as a bearer credential or contain credential material needed to access the mailbox MCP service. The instructions do not require restrictive file permissions, secret-manager storage, log redaction, or credential rotation. If the configuration inherits permissive permissions or is copied into backups, support bundles, shell transcripts, or shared home directories, another party could obtain the endpoint and attempt to invoke the exposed mailbox operations. ### Attack Path 1. A user obtains the DingTalk mailbox MCP URL and runs the documented configuration command. 2. The URL is persisted in `~/.mcporter/mcporter.json`. 3. A local user, compromised process, exposed backup, or accidentally shared configuration gains read access to that file. 4. The attacker extracts the Streamable HTTP URL. 5. The attacker configures a compatible MCP client using the disclosed endpoint. 6. Subject to server-side authorization and token validity, the attacker invokes mailbox enumeration, search, message retrieval, or email-sending operations. ### Impact Assessment Exposure may allow unauthorized use of the mailbox capabilities associated with the endpoint. The documented capabilities include listing available mailboxes, searching messages, retrieving complete email bodies, and sending email as an available mailbox account. This could result in disclosure of confidential correspondence, impersonation through outbound email, phishing, or misuse of organizational communications ...[truncated 102 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store the endpoint credential in an operating-system secret manager or another approved secrets-management system instead of directly embedding it in a general JSON configuration file. - If file storage is unavoidable, create the configuration with owner-only permissions and verify a mode equivalent to `0600`. - Ensure the containing `~/.mcporter` directory is accessible only to the owning user. - Prevent the URL from appearing in command history, process listings, debug logs, screenshots, support bundles, and source control. - Use short-lived, revocable tokens with the minimum mailbox permissions required. - Rotate the token immediately after suspected disclosure. - Document server-side access controls, token expiration, revocation procedures, and audit logging. - Warn users that the Streamable HTTP URL must be treated as a secret rather than as a normal service URL. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents searching mailbox contents and retrieving full email bodies, including sensitive message content, without any privacy or data-handling warning. In an AI assistant setting, this can normalize broad access to confidential communications and increase the chance of over-collection, unauthorized summarization, or exposure of private data to downstream systems or users.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill exposes outbound email-sending capability and even provides batch-sending examples, but does not warn that using the tool transmits data to external recipients and can cause irreversible actions. In an agent context, this increases the risk of unintended disclosure, spam, social engineering, or unauthorized communications if the assistant sends mail without explicit user confirmation.

Static analysis

No suspicious patterns detected.