Security audit

dingtalk-auto-reply

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs Review because it can run persistently, auto-send DingTalk messages as the user, and give chat-triggered agents broad local and account access.

Install only if you intentionally want a persistent DingTalk agent that can send as you. Start with DRY_RUN or TEST_MODE, keep CODE_SEARCH_ROOTS and GROUP_REPLY_PREVIEW disabled unless needed, avoid disabling sandboxing, review any local dingtalk-helper.md and private few-shot files, and confirm the dws, CodeBuddy, gbrain, PATH, and Startup persistence changes are acceptable for your account and machine.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (51)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exposes significant capabilities—environment access, file read/write, shell, network, and MCP—without a clear declared permission model. That mismatch increases the chance users or hosting platforms will underestimate what the skill can do, especially since it also sends messages on the user's behalf and modifies local configuration.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior goes far beyond simple DingTalk auto-reply: it writes .env files, installs persistence, edits user PATH, accesses MCP configuration, searches local code, queries tables, downloads media, and can recover and send missed messages. This description-behavior gap is dangerous because operators may authorize a narrow messaging helper while actually deploying a broadly privileged local automation agent.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The reply agent is intentionally granted broad local and network tooling, including Bash, file inspection, web access, and MCP-backed retrieval, despite the core task being message summarization and reply drafting. Overbroad tool access raises the blast radius if prompts, retrieved content, or model behavior cause unintended actions or data access.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill explicitly documents inspection of arbitrary local source repositories to answer chat questions, which is unrelated to basic DingTalk auto-reply and can expose sensitive code or internal implementation details through automated responses. That broadens the data-access surface from messaging into local intellectual property and secrets present in repositories.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill states group chats only generate WeChat reminders, but later documents a group-reply preview flow that uses AI to generate draft replies for group messages. Even if drafts are not auto-sent, this is still a disclosure mismatch about processing group content and generating responses in a context the user may expect to be excluded.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script prints a prefix of the bearer token and then uses that token to call an external MCP endpoint during validation. Even partial secret disclosure in logs can aid token correlation, and embedding live credential use in a validator expands the blast radius of routine testing beyond local self-checks.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill metadata says it is for unread-monitoring and auto-reply/reminder behavior, but the file grants a much broader ability to explore DingTalk workspace data, query arbitrary tables/wiki content, and summarize internal project data. This creates a scope-expansion risk where a user invoking a messaging helper may unintentionally authorize broad access to enterprise data unrelated to the immediate task.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documented commands include generic DingTalk message send capability, which exceeds the stated framing of limited single-chat auto-reply and group reminder behavior. Once exposed as a general send primitive, the skill could be used to message unintended recipients or perform broader outbound actions than the user expects.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill authorizes shell-based local code and file searching for answering questions, which is unrelated to the core DingTalk auto-reply purpose and expands access into local development assets. That unnecessary capability increases the chance of exposing proprietary source code, secrets, or sensitive implementation details through prompt-driven retrieval.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The instruction to disable the sandbox in order to access local authentication files explicitly weakens a core security boundary. That guidance enables the skill to reach protected credentials and host resources that should remain isolated, substantially increasing the blast radius of any misuse or prompt injection.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The self-ID discovery logic performs a directory search against DingTalk contacts using an environment-supplied display name, which expands the skill's data access beyond unread monitoring and replying. Even if intended for self-test convenience, it can enumerate or query contact-directory data without an explicit user-facing consent boundary, increasing privacy and over-collection risk.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The document states that private, non-distributed examples from a local file are automatically injected at runtime. That creates a path for undisclosed local data to influence model behavior and potentially leak project-specific or sensitive information through generated replies, even though the distributed docs appear sanitized.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill expands from DingTalk auto-reply into local source-code repository inspection, which materially increases accessible data beyond the declared scope. This broadens the blast radius: a messaging workflow can now read internal code and use it in replies, enabling unintended disclosure of proprietary implementation details.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The file claims the distributed content is neutral and non-leaking, but simultaneously documents runtime injection of real local project cases. That mismatch undermines auditability and can conceal sensitive prompt sources from reviewers, making it easier for private context to be exposed without visibility.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This script does more than generate a Startup launcher: it persistently modifies the user's PATH in HKCU\Environment and broadcasts the change to the session. That is a broader persistence and execution-surface change than users would expect from a launcher generator, and it can affect unrelated processes by causing a user-writable node/dws directory to be searched for executables.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code opens HKCU\Environment with write access and updates the Path value, which grants the skill a capability broader than needed to create a Startup VBS file. Registry-based environment modification is persistent and can influence future command resolution for the entire user session, increasing the blast radius if the added directories are writable or later abused.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill gives the LLM broad local capabilities via permissive tool access and bypassPermissions, while only blacklisting a small subset of tools. In an auto-reply skill that processes adversarial chat content, this creates a powerful prompt-injection pathway where external messages can induce local file reads, repository inspection, or network/tool use beyond what is necessary to draft a reply.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The prompt explicitly instructs the model to search arbitrary local code repositories to answer workplace messages, which exceeds the skill's stated DingTalk auto-reply purpose. Because incoming messages are untrusted, a sender can socially engineer the agent into exploring local repositories and surfacing sensitive source code, config values, paths, or implementation details into replies or logs.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The runtime enables optional grounding against arbitrary local code repositories and a network-backed gbrain MCP service, which materially exceeds the narrow task of auto-replying to unread DingTalk messages. In a skill that drafts messages as the user, this broadens the data the AI can access and potentially incorporate into replies, increasing the risk of unintended disclosure of proprietary code, documents, or internal knowledge to message recipients.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: build_sdk_env prepends directories for dws/node binaries into PATH specifically so the agent’s independent Bash/tool contexts can invoke them. That increases the agent’s effective capability from text generation to command-assisted access to DingTalk/workspace tooling, which is risky in an auto-reply skill because a prompt-influenced agent may inspect additional local or account data beyond the original unread message.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly promotes automatic AI replies sent as the user ('以本人身份代复') to unread DingTalk conversations. That creates a real risk of unintended communications, misrepresentation, and autonomous external actions without an equally prominent safety warning, approval gate, or constrained default mode. In this skill context, the danger is elevated because the tool is specifically designed to monitor live chats and send messages on the operator's behalf.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises local codebase retrieval so the agent can answer questions about source code, interfaces, parameters, and implementation details, but it does not present a clear warning about leaking proprietary or sensitive project content into outbound messages. In this context, the risk is substantial because the same system is also configured to automatically reply to coworkers, so retrieved local code details could be disclosed without human review.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill automates replies 'in the user's identity' but the metadata does not present a strong, explicit warning about impersonation and automatic outbound messaging. This is dangerous because users may invoke it as a convenience helper without fully appreciating that it can autonomously send messages as them to colleagues.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill is marked for proactive use on broad requests like checking DingTalk data, summarizing progress, or replying to chats, which can overlap with ordinary conversation and trigger sensitive actions without clear user intent. In a skill that can read internal workspace data and send messages, overly broad activation materially raises the risk of unintended execution.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill includes outbound messaging instructions but lacks strong user-visible warnings or consent around the fact that it may communicate externally as the user. This is dangerous because sending a message is an irreversible external side effect that can cause reputational, operational, or privacy harm if triggered incorrectly.

Static analysis

No suspicious patterns detected.