ClawHub
Back to skill

Security audit

钉钉群聊管理

Security checks for vulnerabilities and agentic risk

Overview

This DingTalk group-management skill is purpose-aligned but needs review because it uses privileged app credentials for collaboration mutations and documents destructive group operations without clear safety controls.

Install only in an environment scoped to the intended DingTalk organization and app. Use a least-privilege DingTalk application, keep DINGTALK_APP_KEY and DINGTALK_APP_SECRET out of shared shells and CI logs, avoid --debug in shared logging contexts, and require explicit human confirmation before any disband or member-removal workflow is added or run.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/create-group.ts:54
Finding

DingTalk Access Token Exposed in URL Query String

Content
View full analysis

Vulnerability Details

File Location: scripts/create-group.ts, lines 54–57
Vulnerability Type: Sensitive token exposure through a URL query parameter
Risk Level: Medium

typescript
const options = {
  hostname: 'oapi.dingtalk.com',
  path: `${path}?access_token=${accessToken}`,
  method,
  headers: {
    'Content-Type': 'application/json',
  } as Record<string, string>,
};

Technical Analysis

The script places the DingTalk access token directly in the HTTPS request URL. TLS protects the request in transit, and the destination is the legitimate DingTalk API domain. However, URL query strings are commonly recorded by reverse proxies, destination access logs, application-performance monitoring systems, diagnostic tooling, and error telemetry.

Consequently, systems with no legitimate need to possess the token may store it in plaintext logs. The implementation does not intentionally print the request URL or token, but it cannot ensure that infrastructure processing the request will redact the query string.

Attack Path

  1. The skill obtains a valid access token using the configured DingTalk application credentials.
  2. The script constructs /chat/create?access_token=<token>.
  3. A proxy, monitoring agent, API gateway, destination server, or diagnostic system records the request target.
  4. An attacker or unauthorized operator obtains access to the resulting logs or telemetry.
  5. The token is extracted from the query string.
  6. Before the token expires or is revoked, the attacker replays it against DingTalk APIs authorized for the application.

This path depends on access to infrastructure logs or telemetry and on the token remaining valid.

Impact Assessment

A leaked token could allow an attacker to exercise the DingTalk permissions granted to the associated application until the token expires or is revoked. Within the functionality demonstrated by this project, this ...[truncated 389 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer a current DingTalk endpoint or SDK operation that accepts the token in an authorization header rather than in the URL.
  2. If the legacy API requires a query-string token, configure proxies, API gateways, HTTP clients, monitoring systems, and destination-side logs to redact access_token values or omit query strings entirely.
  3. Restrict access to logs and telemetry, encrypt them at rest, and apply short retention periods.
  4. Grant the DingTalk application only the minimum permissions needed to create groups.
  5. Establish token-revocation and credential-rotation procedures for suspected exposure.
  6. Ensure debug and error handling never emit complete request URLs.
  7. Add automated tests or log-scrubbing checks that verify sensitive query parameters cannot appear in operational telemetry.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/create-group.ts (reported line 32)May include surrounding context.

ts
}

/**
 * 获取 Access Token
 */
async function getAccessToken(appKey: string, appSecret: string): Promise<string> {
  const config = createConfig();

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill requires environment-based secrets (DINGTALK_APP_KEY and DINGTALK_APP_SECRET) and operationally depends on privileged API access, but it does not declare any explicit tool scope or permission boundary. This can cause the hosting agent to expose environment access implicitly, making the skill's privilege requirements opaque and increasing the risk of unintended secret access or execution in an over-privileged context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill advertises group-management operations, including destructive actions such as disbanding groups and member management, without warning users about operational impact, recovery limitations, or approval requirements. In a collaboration platform context, such actions can disrupt communications, remove users from critical channels, or cause availability and continuity issues if invoked accidentally or through social engineering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented --debug mode outputs request parameters and full API responses but does not warn that logs may contain sensitive identifiers such as user IDs, conversation IDs, error details, and other operational metadata. In shared terminals, CI logs, or centralized logging systems, this can leak internal collaboration data and facilitate further misuse or reconnaissance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Much of the operational description, parameter explanations, examples, and error guidance are provided only in Chinese. This effectively imposes a language requirement on users without opt-in or justification, which matches the language/locale policy concern described in the audit rules.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.