Cross-Platform IM CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:54 AM UTC
• Version: 1.0.0

Overview

The skill fits its enterprise messaging purpose, but it needs Review because it can install authenticated messaging CLIs and its examples send broad broadcasts without clear confirmation boundaries.

Install only in a controlled environment, verify and pin the CLI packages before authenticating, use least-privileged platform accounts, and require an explicit preview plus confirmation before any DING, all-user, or multi-platform broadcast.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Global Installation of Authenticated Enterprise Messaging CLIs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-37
Vulnerability Type: Unpinned third-party dependencies installed globally
Risk Level: Medium

Vulnerable Code

bash

npm install -g @larksuite/cli && lark auth login

bash

npm install -g dingtalk-workspace-cli && dws auth login

bash

npm install -g @wecom/cli && wecom auth login

Technical Analysis

The documented installation commands retrieve the latest versions of three npm packages rather than exact, reviewed versions. Although the skill describes minimum CLI versions, it does not enforce those versions with package specifiers, lockfiles, integrity hashes, or provenance verification.

Installing packages globally increases exposure because npm package installation and lifecycle scripts execute with the invoking user's privileges and can place executable files in a global command path. The instructions then immediately authenticate the installed tools against enterprise communication platforms. Consequently, a compromised or unexpectedly modified package release could access authentication material, intercept enterprise information, or perform actions through authenticated user sessions.

No evidence establishes that these packages are currently malicious. The issue is the unsafe and mutable dependency acquisition process.

Attack Path

1. An attacker compromises a referenced npm package, its publisher account, or its release pipeline, or causes an unsafe replacement release to become the version resolved by npm.
2. A user follows the skill instructions and runs an unpinned global installation command.
3. npm downloads the attacker-controlled release and may execute its installation or lifecycle scripts with the user's local privileges.
4. The malicious package installs or replaces a globally accessible CLI executable.
5. The user runs the immediately following authentication command and grants the compromised CLI access to an en ...[truncated 1010 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an exact reviewed version, such as @larksuite/cli@1.0.40, rather than relying on the latest package release.
2. Prefer project-local installation over global installation so dependency versions and executable resolution remain isolated and reproducible.
3. Maintain a lockfile and use a reproducible installation command such as npm ci where the packaging model permits it.
4. Verify npm publisher identity, package provenance, release signatures, and registry source before installation.
5. Validate package integrity using trusted checksums or lockfile integrity metadata obtained through a controlled review process.
6. Disable npm lifecycle scripts with --ignore-scripts when the reviewed CLIs do not require them. If scripts are required, inspect them before execution.
7. Run the CLIs under a dedicated, least-privileged operating-system account or isolated environment.
8. Authenticate only after verifying the installed executable path, version, package contents, and cryptographic integrity.
9. Grant each enterprise integration only the minimum scopes required for the selected workflow, and provide a documented process for revoking credentials.
10. Periodically review pinned versions and upgrade them through a controlled security assessment rather than automatically resolving new releases.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list is broad enough to activate on generic messaging, notification, or workflow requests, which can cause the wrong skill to take control of unrelated tasks. In a security-sensitive agent environment, overbroad activation increases the chance of unintended cross-platform actions, message sending, or data aggregation when the user did not clearly request enterprise IM orchestration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill is framed as an expert for China's major enterprise IM platforms and the examples and outputs are presented in Chinese-oriented messaging by default. There is no natural-language indication that users may choose another language or locale for generated content, which can violate language/locale choice expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states a safety rule to preview multi-platform broadcasts before sending, but the workflow examples immediately send mass notifications without a review or confirmation step. In an agent setting, contradictory guidance is dangerous because the executable examples are likely to be followed over the prose rule, increasing the risk of accidental spam, over-broadcasting, or disclosure of incident information to unintended audiences.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The closing guidance says "This skill → Cross-platform orchestration only" and instructs not to duplicate single-platform logic. Yet the body contains many direct single-platform procedures and platform-specific command patterns for Feishu, DingTalk, and WeCom individually, rather than only orchestration/delegation guidance. While not inherently unsafe, this is a documentation-level intent mismatch.

Content

No source excerpt is available for this finding.