ClawHub
Back to skill

Security audit

Dingtalk File Send

Security checks for vulnerabilities and agentic risk

Overview

This skill is a DingTalk file-sending helper that does what it claims, but users should verify the file, account, and recipient before use.

Install only if you want the agent to send local files through DingTalk using configured DingTalk credentials. Before each use, confirm the exact file path, the DingTalk account binding, and the recipient user ID, especially for confidential documents.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill is explicitly designed to upload local files and send them, along with recipient identifiers, to DingTalk, but the user-facing guidance does not clearly warn about that external transmission. This creates a meaningful consent and data-handling risk because users may trigger the skill without understanding that local content and metadata leave the machine and are stored/processed by a third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 2: Get Access Token

```bash
ACCESS_TOKEN=$(curl -s -X POST "https://api.dingtalk.com/v1.0/oauth2/accessToken" \
  -H "Content-Type: application/json" \
  -d "{\"appKey\":\"$APP_KEY\",\"appSecret\":\"$APP_SECRET\"}" | jq -r '.accessToken')
Confidence
96% confidence
Finding
This request sends app credentials to DingTalk to obtain an access token. Although this is expected functionality for the integration, it is still a real external transmission of secrets to a third-party service, so the risk is legitimate if users or operators are not clearly informed and if logs/process tracing expose the request.

External Transmission

Medium
Category
Data Exfiltration
Content
userIds: [$userId]
  }')

SEND_RESULT=$(curl -s -X POST "https://api.dingtalk.com/v1.0/robot/oToMessages/batchSend" \
  -H "Content-Type: application/json" \
  -H "x-acs-dingtalk-access-token: $ACCESS_TOKEN" \
  -d "$PAYLOAD")
Confidence
98% confidence
Finding
This request transmits the message payload, including recipient user ID and file metadata, to DingTalk's messaging API. That is the core purpose of the skill, but it is still a genuine data egress path and therefore a true security/privacy concern if used with sensitive files or recipients without explicit confirmation.

External Transmission

Medium
Category
Data Exfiltration
Content
FILE_EXT="${FILE_NAME##*.}"

# Get access token
ACCESS_TOKEN=$(curl -s -X POST "https://api.dingtalk.com/v1.0/oauth2/accessToken" \
  -H "Content-Type: application/json" \
  -d "{\"appKey\":\"$APP_KEY\",\"appSecret\":\"$APP_SECRET\"}" | jq -r '.accessToken')
Confidence
96% confidence
Finding
This is the same credential transmission pattern in the complete script: appKey and appSecret are sent to DingTalk to mint an access token. It is expected for OAuth-style authentication, but remains a true external transmission of secrets and should be treated as sensitive behavior rather than dismissed as harmless.

External Transmission

Medium
Category
Data Exfiltration
Content
--arg userId "$USER_ID" \
  '{robotCode:$robotCode,msgKey:$msgKey,msgParam:({mediaId:$mediaId,fileName:$fileName,fileType:$fileType}|tojson),userIds:[$userId]}')

SEND_RESULT=$(curl -s -X POST "https://api.dingtalk.com/v1.0/robot/oToMessages/batchSend" \
  -H "Content-Type: application/json" \
  -H "x-acs-dingtalk-access-token: $ACCESS_TOKEN" \
  -d "$PAYLOAD")
Confidence
98% confidence
Finding
This complete-script send operation transmits recipient and file-related data to DingTalk. Because the skill auto-detects an account and can send arbitrary user-specified files, the context increases the chance of unintended disclosure if the operator misunderstands what is being uploaded or which account is used.

External Transmission

Medium
Category
Data Exfiltration
Content
### Step 2: Get Access Token

```bash
ACCESS_TOKEN=$(curl -s -X POST "https://api.dingtalk.com/v1.0/oauth2/accessToken" \
  -H "Content-Type: application/json" \
  -d "{\"appKey\":\"$APP_KEY\",\"appSecret\":\"$APP_SECRET\"}" | jq -r '.accessToken')
Confidence
96% confidence
Finding
This request sends app credentials to DingTalk to obtain an access token. Although this is expected functionality for the integration, it is still a real external transmission of secrets to a third-party service, so the risk is legitimate if users or operators are not clearly informed and if logs/process tracing expose the request.

External Transmission

Medium
Category
Data Exfiltration
Content
userIds: [$userId]
  }')

SEND_RESULT=$(curl -s -X POST "https://api.dingtalk.com/v1.0/robot/oToMessages/batchSend" \
  -H "Content-Type: application/json" \
  -H "x-acs-dingtalk-access-token: $ACCESS_TOKEN" \
  -d "$PAYLOAD")
Confidence
98% confidence
Finding
This request transmits the message payload, including recipient user ID and file metadata, to DingTalk's messaging API. That is the core purpose of the skill, but it is still a genuine data egress path and therefore a true security/privacy concern if used with sensitive files or recipients without explicit confirmation.

External Transmission

Medium
Category
Data Exfiltration
Content
FILE_EXT="${FILE_NAME##*.}"

# Get access token
ACCESS_TOKEN=$(curl -s -X POST "https://api.dingtalk.com/v1.0/oauth2/accessToken" \
  -H "Content-Type: application/json" \
  -d "{\"appKey\":\"$APP_KEY\",\"appSecret\":\"$APP_SECRET\"}" | jq -r '.accessToken')
Confidence
96% confidence
Finding
This is the same credential transmission pattern in the complete script: appKey and appSecret are sent to DingTalk to mint an access token. It is expected for OAuth-style authentication, but remains a true external transmission of secrets and should be treated as sensitive behavior rather than dismissed as harmless.

External Transmission

Medium
Category
Data Exfiltration
Content
--arg userId "$USER_ID" \
  '{robotCode:$robotCode,msgKey:$msgKey,msgParam:({mediaId:$mediaId,fileName:$fileName,fileType:$fileType}|tojson),userIds:[$userId]}')

SEND_RESULT=$(curl -s -X POST "https://api.dingtalk.com/v1.0/robot/oToMessages/batchSend" \
  -H "Content-Type: application/json" \
  -H "x-acs-dingtalk-access-token: $ACCESS_TOKEN" \
  -d "$PAYLOAD")
Confidence
98% confidence
Finding
This complete-script send operation transmits recipient and file-related data to DingTalk. Because the skill auto-detects an account and can send arbitrary user-specified files, the context increases the chance of unintended disclosure if the operator misunderstands what is being uploaded or which account is used.

Static analysis

No suspicious patterns detected.