DingTalk MCP

• Outcome: Review
• Latest audit: Sep 8, 2026 · 2:35 AM UTC
• Version: 1.0.0

Overview

The skill is a DingTalk connector wrapper, but it under-describes a generic action path that may send, overwrite, cancel, or delete DingTalk data and includes risky one-line remote installer commands.

Review this skill before installing. Use it only when you are comfortable with a DingTalk MCP connector that can potentially perform write or destructive actions through call_tool, and require explicit confirmation for every non-read operation. Avoid running the remote installer one-liners unless you have independently verified the installer source and scope.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:56
• Finding: Unverified Remote Shell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 56 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ### Technical Analysis The installation command pipes the response from an external URL directly into `bash`. The downloaded script is neither pinned to a specific release nor validated using a cryptographic signature or checksum. Its effective content can therefore change after the Skill has been reviewed. HTTPS protects the connection in transit but does not establish the integrity of a particular installer version. Compromise of the hosting service, vendor account, release pipeline, or associated infrastructure could cause arbitrary shell commands to be returned and immediately executed. Installing the required CLI may be necessary for first-time setup, but granting a mutable network response direct shell execution is not necessary. This behavior exceeds the minimum privileges required for the Skill's declared DingTalk connector functionality. ### Attack Path 1. The `oo` CLI is unavailable, causing the user or agent to follow the first-time setup instructions. 2. The command requests `https://cli.oomol.com/install.sh`. 3. The remote endpoint or its software supply chain supplies modified installer content. 4. `curl` sends that content directly to `bash` without local review or integrity validation. 5. The payload executes with the privileges of the user running the command. ### Impact Assessment A compromised installer could execute arbitrary commands with the invoking user's privileges. Depending on those privileges and the local environment, it could read or modify user files, access environment variables and locally available credentials, install additional software, alter shell configuration, or establish persistence. The reviewed file does not demonstrate that the current remot ...[truncated 158 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | bash` installation command. - Prefer an official operating-system package manager or a versioned release artifact. - Pin installation instructions to a specific CLI version. - Download the installer or binary to a local file before use rather than executing the network response directly. - Publish and verify a cryptographic checksum or digital signature from an independently authenticated channel. - Allow the user to inspect the downloaded installer before explicitly running it. - Do not let an agent automatically install the CLI; require informed user approval for software installation. - Run installation with ordinary user privileges unless elevated privileges are explicitly required and justified.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60
• Finding: Unverified Remote PowerShell Script Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, line 60 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis `irm` retrieves a PowerShell script from an external URL and passes the response directly to `iex` (`Invoke-Expression`). This causes the response to be interpreted as executable PowerShell without version pinning, signature verification, checksum validation, or an opportunity for local inspection. The command makes the reviewed Skill dependent on mutable server-side content. If the remote host, vendor account, deployment pipeline, or related infrastructure is compromised, attacker-controlled PowerShell can execute immediately. Transport encryption alone does not guarantee that the returned script is the same artifact that was intended or previously audited. Although installing the CLI may support the declared functionality, executing mutable remote content through `Invoke-Expression` grants substantially broader capabilities than the DingTalk connector operations require. ### Attack Path 1. A Windows user encounters an `oo: command not found` condition and follows the first-time setup instructions. 2. `Invoke-RestMethod` retrieves `https://cli.oomol.com/install.ps1`. 3. An attacker who has compromised the delivery infrastructure causes the endpoint to return modified PowerShell. 4. The pipeline passes the response directly to `Invoke-Expression`. 5. The attacker-controlled commands execute in the user's PowerShell security context. ### Impact Assessment The remote response can perform any operation available to the invoking PowerShell process. Potential impact includes reading or modifying user data, accessing locally available credentials, changing PowerShell profiles, downloading further components, or creating persistence. If the user launches PowerSh ...[truncated 319 chars]
• Remediation: ## Remediation Suggestions - Remove the `irm | iex` pattern. - Distribute a versioned, signed Windows package through a trusted package manager or official release channel. - Download the installer to disk and verify its Authenticode signature and expected publisher before execution. - Pin the installer to a specific release and publish a cryptographic checksum through an independently authenticated channel. - Require explicit user review and approval before executing installation code. - Avoid automatically requesting or using administrator privileges. - Document the files, configuration changes, and permissions required by the installer so users can assess its scope.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill metadata and description frame the integration as suitable for 'searching and reading data,' but the documented `call_tool` action is a generic dispatcher that may invoke write or destructive DingTalk operations. This mismatch can cause downstream agents or users to trust and invoke the skill in read-only contexts, leading to unintended state changes, message sends, overwrites, or deletions.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The safety section states that untagged actions are reads, yet `call_tool` is untagged even though its own description says it may expose actions that send, overwrite, cancel, or delete data. This creates a dangerous contradiction that can cause an agent to treat a powerful generic execution path as safe-by-default and run mutating operations without confirmation.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger text says to use this skill for 'ANY DingTalk MCP request' and 'instead of calling the API directly,' which is overly broad for a skill that can surface arbitrary live tools through `call_tool`. Broad routing increases the chance the skill is invoked in situations where its mutating capabilities are not expected, expanding the attack surface and the likelihood of unintended actions.

Static analysis

No suspicious patterns detected.