Dingtalk Calendar

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only DingTalk calendar skill is coherent, but it can access and change DingTalk calendar, meeting-room, and contact data through an external MCP setup.

This skill appears purpose-aligned for DingTalk calendar management. Before installing, verify the mcporter package and MCP URLs, connect only the intended DingTalk account, and require clear confirmation before creating, updating, deleting, or booking calendar resources.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If invoked with the wrong event ID, time, attendee list, or room ID, the agent could change workplace calendar data or bookings.

Why it was flagged

The skill documents direct MCP tool calls that can modify or delete calendar events and reserve meeting rooms.

Skill content
mcporter call dingtalk-calendar update_calendar_event ... delete_calendar_event ... add_meeting_room
Recommendation

Review event details before create/update/delete or room-booking actions, and require explicit user confirmation for destructive changes.

What this means

The agent may be able to read or change DingTalk calendar information and look up contact details according to the connected account’s privileges.

Why it was flagged

The skill relies on DingTalk MCP services that operate with whatever account or workspace permissions the configured URLs provide.

Skill content
本技能需要配置两个 MCP 服务:钉钉日历 和 钉钉通讯录
Recommendation

Connect only the intended DingTalk workspace/account, protect the MCP URLs, and use the least privileges available.

What this means

Security depends partly on the external mcporter package and the DingTalk MCP endpoints the user configures.

Why it was flagged

The skill asks the user to globally install an external CLI that is central to the workflow; the provided artifacts do not include that CLI code.

Skill content
npm install -g mcporter ... bun install -g mcporter
Recommendation

Install mcporter from a trusted registry, verify the package/version, and copy MCP URLs only from the official DingTalk MCP site.

What this means

Calendar, attendee, room, busy-status, and contact queries may be sent to the configured DingTalk MCP services.

Why it was flagged

Calendar and contact operations are routed through externally configured MCP server URLs.

Skill content
访问钉钉 MCP 广场:https://mcp.dingtalk.com ... 获取 Streamable HTTP URL
Recommendation

Use only official or trusted MCP endpoints and avoid sharing copied MCP URLs with others.