DingTalk Todo CLI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent DingTalk task-management guide, but it gives an agent broad authenticated DingTalk authority and includes an automatic high-level escalation path that conflicts with its own confirmation rule.

Install only if you are comfortable giving the agent access to DingTalk through the authenticated dws CLI. Use a least-privileged DingTalk account, pin and verify the CLI version, avoid raw dws api call usage unless you explicitly approve each endpoint, and require confirmation before any DING to managers, directors, HR, groups, or external platforms.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Global Installation of an Authenticated Third-Party CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16-25
Vulnerability Type: Unpinned third-party dependency and unsafe global installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Install
npm install -g dingtalk-workspace-cli

# Authenticate
dws auth login

# Verify
dws auth status

Technical Analysis

The Skill instructs users to install dingtalk-workspace-cli globally without specifying an exact version or verifying the package's integrity, provenance, publisher, or registry source. Consequently, the installed package can vary over time even though the reviewed Skill remains unchanged.

npm packages may execute lifecycle scripts during installation. A malicious or compromised release could therefore run code with the privileges of the user performing the installation. Global installation also exposes the resulting executable system-wide for that user's environment.

The risk is amplified because the newly installed dws executable is immediately used for DingTalk authentication. A compromised package could intercept authentication tokens, modify CLI requests, access data authorized through the account, or perform unauthorized DingTalk operations.

Attack Path

1. An attacker compromises the npm package, its publisher account, or one of its transitive dependencies.
2. The attacker publishes a malicious release under the package name used by the Skill.
3. A user follows the documented command, which resolves the latest available version because no exact version is pinned.
4. Malicious package lifecycle code executes during the global installation, or malicious runtime code executes when dws is invoked.
5. The user runs dws auth login, allowing the compromised CLI to observe or capture authentication material.
6. The attacker abuses the captured session or alters CLI operations to access or modify DingTalk resources within the user's authorized scope.

...[truncated 570 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact reviewed version, for example:

   bash

   npm install -g dingtalk-workspace-cli@1.0.32
   

2. Verify the selected version's publisher, provenance, release history, and integrity before recommending it.
3. Explicitly use the trusted official npm registry and prevent dependency resolution from untrusted registries.
4. Prefer a project-local installation with a committed lockfile over a global installation where operationally feasible.
5. Disable npm lifecycle scripts during installation if the package does not require them, then validate that the CLI remains functional.
6. Execute the CLI under a dedicated, least-privileged operating-system account or isolated environment.
7. Authenticate using a least-privileged DingTalk account or application whose scopes are limited to the required workflows.
8. Document token revocation and credential-rotation procedures for responding to a suspected package compromise.
9. Periodically review pinned versions for security updates and upgrade only after validating the new release.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow automatically sends a Level 3 escalation to a director when tasks are overdue more than three days, directly contradicting the later safety rule that Level 3+ DING escalations require user confirmation. This inconsistency can cause unauthorized high-visibility notifications, reputational harm, and workflow abuse by an agent acting without human approval.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Exposing a generic dws api call primitive gives the agent an unconstrained path to invoke arbitrary DingTalk OpenAPI endpoints beyond the stated todo workflow purpose. In practice this can bypass the skill's narrower safety framing and allow access to sensitive data or privileged mutations in other product areas, depending on the authenticated account's permissions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is presented as a focused DingTalk todo/task manager, but it documents capabilities across unrelated domains such as approvals, attendance, drive, bot messaging, and raw API access. That scope expansion increases the chance an agent will invoke higher-privilege operations than the user expects, undermining least privilege and enabling unintended data access or actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md

2. **Confirm before DING escalation**: Level 3+ escalations require user confirmation
3. **Rate limiting**: Max 10 DINGs per hour; batch notifications when possible
4. **Auth check**: Always run `dws auth status` before workflows
5. **No delete without confirmation**: `dws todo delete` requires explicit user approval
6. **Respect working hours**: Avoid DING outside 9:00-21:00 unless marked urgent
7. **Batch over individual**: When notifying a team, prefer one DING to multiple