Security audit

Huo15 Dingtalk Connector Pro

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real DingTalk connector, but it needs Review because it can automatically transmit local files and perform high-impact DingTalk send/document actions without clear built-in scoping.

Install only if you trust the publisher and can restrict who may call this plugin. Use least-privilege DingTalk credentials, set DM/group allowlists, review gateway method exposure, avoid helper install scripts unless you accept OpenClaw config changes, and disable or patch automatic local-path media upload unless your workflow explicitly needs it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (45)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill metadata declares no required permissions, yet the analyzed capabilities indicate access to environment data, filesystem read/write, network, and shell operations. For a connector that can modify local OpenClaw configuration, clone repositories, and interact with external services, this under-declaration prevents informed consent and weakens any permission-based trust boundary, making abuse or accidental overreach harder to detect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The stated description presents the skill mainly as a DingTalk connector with memory/session features, but the detected behavior extends to proactive messaging, document read/write/search/create, media upload/download, multi-account handling, local config modification, repository cloning, and shelling out to external tools. This mismatch is dangerous because users and reviewers may approve the skill under a narrower trust assumption while it actually has broad messaging, data access, and system-modification capability.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Advertising Claude Code capability enhancement as present behavior when the roadmap says it is still in progress can cause users to rely on undocumented prompt injection, memory retrieval, or policy behaviors that are not actually available. In an agent connector, inaccurate claims about instruction or memory features increase the risk of unsafe deployment assumptions and improper trust boundaries.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Advertising Claude Code capability enhancement as present behavior when the roadmap says it is still in progress can cause users to rely on undocumented prompt injection, memory retrieval, or policy behaviors that are not actually available. In an agent connector, inaccurate claims about instruction or memory features increase the risk of unsafe deployment assumptions and improper trust boundaries.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The schema explicitly allows secrets to be sourced via `{ source: "exec" }`, which means secret resolution may invoke external commands. In a connector context this expands the trust boundary from configuration parsing to command execution, creating a code-execution pathway if config or secret-provider settings are attacker-controlled or insufficiently restricted.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The status gateway returns the configured clientId to any caller of the method. While a clientId is not usually secret like a clientSecret, unnecessary disclosure of internal integration identifiers increases information exposure and can aid reconnaissance or targeted abuse of the DingTalk app configuration.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The connector exposes proactive outbound messaging methods for arbitrary users and groups, which materially exceeds the stated passive connector role. In an agent-skill context, this enables covert or unauthorized message delivery, spam, impersonation of business workflow actions, and exfiltration through outbound channels if the skill is invoked by another component.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The code downloads user-supplied media and files, stores them locally, and parses document contents, which creates a clear ingestion and exfiltration surface beyond the declared connector scope. This is dangerous because untrusted attachments can trigger sensitive local file handling, resource exhaustion, malware staging, or unintended disclosure of extracted document contents to downstream models or logs.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The connector scans arbitrary response text for absolute local file paths and automatically uploads matching files to DingTalk. This creates a content-triggered local file exfiltration path: any model output or untrusted content containing a host path can cause unintended disclosure of local files without explicit user intent or approval.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The implementation supports discovering local media paths in content and uploading those files, but the skill metadata does not clearly disclose this sensitive behavior. This mismatch undermines informed consent and makes accidental or adversarial exfiltration more likely because operators may deploy the skill without understanding that local filesystem references can trigger network transfer.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The function calls fs.statSync(mediaUrl) on a value that is treated elsewhere as a media URL/path, which means attacker-controlled input can trigger local filesystem access against arbitrary paths. Even though it only reads metadata, this can disclose file existence and size, create side channels about host files, and cause crashes or unintended access to sensitive local paths when the connector should only be relaying DingTalk messages.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The handler automatically downloads attachments, stores them locally, parses document and source/text files, and injects their contents into the agent prompt context. For a messaging connector, this materially expands the trust boundary and can expose sensitive documents, secrets, source code, or internal data to downstream model/tool execution without clear user consent or strict type/size/policy controls.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code injects mandatory instructions that force the agent to use other skills or URL-reading capabilities based on message links. This creates an unintended privilege/behavior escalation path where a simple DingTalk message can coerce cross-skill access to external or internal content, increasing the risk of SSRF-like access, over-broad data retrieval, and tool misuse beyond the connector's declared role.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The plugin description emphasizes messaging, session management, and AI Card streaming, but this file also exposes broad document read/create/append/search/list RPC methods. That scope expansion increases the plugin's effective authority and attack surface, enabling access to or modification of DingTalk documents that users or integrators may not expect from the advertised functionality.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The exposed docs.create and docs.append gateway methods allow creating and modifying DingTalk documents, but these capabilities are not justified by the stated plugin purpose. In an agent environment, undocumented write capabilities are risky because another component may invoke them to alter user data or persist content without informed consent.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code scans arbitrary absolute file paths embedded in message content, then uploads matching local files to DingTalk and sends them onward automatically. This creates a clear local file exfiltration path from untrusted content or model output, which is especially dangerous because the connector's stated purpose does not justify broad filesystem access and transfer.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: In finishAICard, streamAICard is called as streamAICard(card, fixedContent, true, log), but the fourth parameter is documented as config, not logger. This means the logger object is treated as configuration, preventing proper token refresh and potentially causing expired or malformed credentials to be used during the final streaming update, which can break message delivery or cause runtime errors.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README instructs users to place DingTalk client credentials directly into a plaintext OpenClaw configuration file, but does not warn about protecting that file from source control, backups, or log disclosure. This creates a realistic secret-handling weakness because bot credentials can be stolen from misconfigured repositories, screenshots, shared configs, or support bundles and then abused to impersonate the bot or access related APIs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises persistent conversation context, session sharing, and file/media handling, but does not explain retention, access controls, consent, or privacy implications. For a chat connector that processes attachments and ongoing conversations, omission of these details can lead administrators to deploy it in ways that expose sensitive business or personal data.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The client exposes write-capable methods such as appendToDoc() and createDoc() that directly modify DingTalk documents once valid credentials are present, with no built-in confirmation, policy check, or explicit safeguard before performing the action. In an agent skill context, this increases the risk of unintended or prompt-induced state changes to user documents, especially because the same module also supports reading and listing documents and appears designed for autonomous use.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code uploads local files to DingTalk as soon as matching content is detected, with no user-facing warning, confirmation, or review step. That means sensitive local data can be transmitted off-host based solely on generated or attacker-influenced content, making accidental disclosure plausible.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The code executes ffprobe on supplied file paths without transparency or approval, and it uses a shell command string via child_process.exec. If an attacker can influence the file path content, this can become command injection or at minimum an unexpected local command execution primitive, which is risky for a connector handling untrusted content.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Raw local media and file paths found in free-form content are automatically uploaded and sent with no warning or consent step. In this skill context, that is especially dangerous because a messaging connector processes model outputs and conversation content, so untrusted text can directly trigger exfiltration of host files to external recipients.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code reads local file contents directly from a supplied path via fs.readFileSync(filePath, 'utf-8') and only gates on file extension, not on trust boundary, user consent, or path restrictions. In an agent/connector context, if an attacker can influence filePath or the file marker input path upstream, this can expose arbitrary local text files or sensitive data from the host environment.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The function extracts file paths from content markers, resolves them to local paths, and uploads them to DingTalk when an oapiToken is present, with no visible confirmation, authorization check, or provenance validation for the referenced files. This creates a direct local-file-to-network exfiltration path, which is especially dangerous in an agent integration that may process semi-untrusted content.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test.ts:262

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: test.ts:254

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: tests/audio/audio.test.ts:46

File read combined with network send (possible exfiltration).

Warn

Code: suspicious.potential_exfiltration
Location: test.ts:167

File read combined with network send (possible exfiltration).

Warn

Code: suspicious.potential_exfiltration
Location: tests/chunk-upload/chunk-upload.test.ts:35