Security checks across malware telemetry and agentic risk
This skill is a real DingTalk message-sending automation tool, but it needs review because it can control the desktop, capture screenshots, send messages, optionally upload screenshots, and has a concrete shell-injection weakness.
Install only if you intentionally want a desktop-control tool that can send real DingTalk messages. Review recipient and message text before invocation, avoid using untrusted contact names or message content until shell=True command construction is fixed, treat QR-code screenshots as sensitive, and leave --vision disabled unless you explicitly accept sending screenshots to DashScope.
def run(cmd, timeout=15):
log(f"→ {cmd[:120]}")
result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
if result.returncode != 0 and result.stderr:
log(f" stderr: {result.stderr[:200]}")
return result64/64 vendors flagged this skill as clean.