Security audit

DingTalk CLI Auto

Security checks for vulnerabilities and agentic risk

Overview

This DingTalk automation skill is purpose-aligned, but it needs review because its install guidance and runtime code can expose users to unsafe local command execution and overbroad network requests.

Install only after the publisher replaces remote shell-piped installer commands with pinned, verifiable releases and fixes the command execution wrapper to use argument arrays without a shell. Treat DingTalk AppKey/AppSecret, OAuth state, robot webhooks, contact data, calendars, and todos as sensitive business access, and avoid using this skill on production credentials until those issues are corrected.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:17
Finding: Unverified Remote Installer Is Piped Directly Into a Shell
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/dws.js:21
Finding: Shell Command Injection Through DWS Command Construction
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/message.js:73
Finding: Unrestricted Robot Webhook URL Enables Server-Side Request Forgery
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package-lock.json:20
Finding: Dependency Lockfile Retrieves Packages Through a Third-Party Registry Mirror
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (66)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The '| sh' pattern creates an execution chain where untrusted network content is fed directly into a shell without any review or integrity verification. In the context of an enterprise automation skill that also handles app credentials, compromise of the installer path could lead to immediate code execution and theft of DingTalk secrets or broader workstation compromise.
Content: Scanner excerpt · README.md (reported line 19)May include surrounding context.
bash
# Linux/macOS curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh # 验证安装 dws --version

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The '| sh' and 'iex' chaining pattern converts downloaded remote content directly into executable shell/PowerShell commands, eliminating any review barrier. This is a classic command-chaining abuse vector that enables full compromise if the upstream script is altered or if users are socially engineered into trusting a malicious mirror or fork.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
bash
# Linux/macOS curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh # Windows PowerShell irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
node scripts/calendar.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
node scripts/calendar.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
node scripts/calendar.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
node scripts/calendar.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
node scripts/calendar.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
md
node scripts/calendar.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
node scripts/todo.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
md
node scripts/todo.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
md
node scripts/todo.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
node scripts/todo.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
md
node scripts/todo.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
md
node scripts/todo.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.
md
node scripts/todo.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.
md
node scripts/todo.js create \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
node scripts/contact.js search --name "张三"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.
md
node scripts/contact.js search --name "张三"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.
md
node scripts/contact.js search --name "张三"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
md
node scripts/contact.js search --name "张三"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
node scripts/contact.js search --name "张三"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
node scripts/robot.js send \

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The same direct command chaining appears again in troubleshooting, reinforcing an unsafe operational habit and making exploitation easier during support scenarios. Because this skill deals with enterprise credentials and automation context, compromise of the host could also expose AppKey/AppSecret values and authenticated CLI state.
Content: Scanner excerpt · SKILL.md (reported line 369)May include surrounding context.
export PATH="$HOME/.local/bin:$PATH"

重新安装

curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh

text
### 问题：认证失败

Known Vulnerable Dependency: axios==1.14.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: The lockfile pins axios to 1.14.0, and the finding cites multiple known advisories, including SSRF-related proxy bypass and prototype-pollution-assisted attack paths. Because this is a CLI automation tool that makes outbound HTTP requests, a vulnerable HTTP client library is directly security-relevant and could expose credentials, enable request tampering, or bypass network egress controls depending on how the application uses axios.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 84% confidence
Finding: form-data 4.0.5 is reported as vulnerable to CRLF injection via unescaped multipart field names and filenames. If this skill ever builds multipart requests from untrusted input, an attacker may be able to manipulate request structure, smuggle fields, or tamper with downstream parsing on receiving systems.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: lib/dws.js:21

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Chaining Abuse

Chaining Abuse

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Chaining Abuse

重新安装

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Static analysis

Shell command execution detected (child_process).