ClawHub
Back to skill

Security audit

DingTalk Bot

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for sending DingTalk bot messages, but its setup instructions include unverified remote shell installers and its routing description is broader than the actions it documents.

Review this skill before installing. It can send DingTalk bot messages through an OOMOL-connected account, so confirm message payloads before use. Avoid running the documented one-line installer commands unless you trust the OOMOL CLI distribution path; prefer a verified, versioned, or manually inspected installation method.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:59
Finding

Unverified Remote Installation Scripts Executed Directly by Shells

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59–63
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
powershell
irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell

Technical Analysis

The installation instructions download mutable content from cli.oomol.com and immediately execute the response with Bash or PowerShell. They do not pin a release version, verify a cryptographic signature or checksum, save the installer for inspection, or use a constrained execution environment.

Although the download domain is consistent with the declared OOMOL provider, the retrieved scripts are not included in the audited project. Their contents and future changes therefore cannot be reviewed as part of this Skill. Compromise of the hosting infrastructure, publishing account, DNS path, or TLS termination environment could cause attacker-controlled commands to be executed.

Installing the CLI is only a conditional setup operation and is not required for ordinary DingTalk connector actions when the CLI is already present. Automatically executing an unverified installer exceeds the minimum privileges necessary to send DingTalk messages.

Attack Path

  1. The oo CLI is unavailable, causing the first-time setup instructions to be used.
  2. The user or agent runs one of the documented installation commands.
  3. The command retrieves the current response from the external OOMOL installation endpoint.
  4. No version, checksum, or signature is validated.
  5. Bash or PowerShell immediately interprets the downloaded response.
  6. If the remote distribution path has been compromised, attacker-supplied commands execute with the permissions of the invoking user.

Impact Assessment

A malicious remote installer could execute arbitrary commands with ...[truncated 530 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove direct pipe-to-shell and Invoke-Expression installation commands.
  • Direct users to a pinned, versioned release artifact from an official distribution channel.
  • Download the installer or binary to disk without executing it automatically.
  • Verify the artifact against a publisher-signed manifest or a pinned SHA-256 checksum distributed through an independent trusted channel.
  • Provide commands that stop immediately when integrity or signature verification fails.
  • Allow users to inspect the downloaded artifact before execution.
  • Require explicit user approval before installing software or making system changes.
  • Prefer a trusted operating-system package manager or signed package format where available.
  • Run installation with ordinary user permissions unless a specific, documented operation requires elevation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs the agent to install software by piping a remote script directly into bash. This pattern is dangerous because it executes unverified code from the network without integrity checking, so a compromised host, TLS interception, or upstream supply-chain attack could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description says to use this skill for ANY DingTalk Bot request and instead of calling the API directly, which is an overly broad routing trigger. This can cause the agent to invoke the skill in situations it does not fully support or where safer, narrower handling would be preferable, increasing the chance of unintended writes or misuse of connected credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.