Dida365 Cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:24 PM UTC
• Version: 3.0.3

Overview

The skill has a coherent task-management purpose, but it relies on broad private-API account access, command-line session-cookie handling, and unpinned npm execution that users should review carefully before installing.

Install only if you are comfortable giving this CLI broad access to your Dida365 account. Verify the npm package identity and version before running it, avoid pasting session cookies into shared terminals or agent logs, prefer safer secret input if available, and treat `sync all` JSON and delete or batch commands as sensitive account data operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:11
• Finding: Unpinned and Inconsistent npm Package Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 11-14 **Vulnerability Type**: Third-party package supply-chain exposure **Risk Level**: High ### Vulnerable Code ```bash npx dida365 <command> [options] npm install -g dida365-ai-tools ``` ### Technical Analysis The recommended `npx` package name, `dida365`, differs from the package installed by the alternative global installation command, `dida365-ai-tools`. The documentation does not establish that these packages are maintained by the same trusted publisher or provide an equivalent implementation. The `npx dida365` command may download and immediately execute the currently resolved package version. No exact version, integrity hash, lockfile, or package provenance validation is specified. Consequently, future compromise of the package, namespace confusion, or selection of an unrelated package could cause unreviewed code to execute locally. Because the CLI is also expected to handle a Dida365 session Cookie, a malicious dependency could potentially access both the user's local environment and the supplied authentication credential. ### Attack Path 1. A user follows the recommended `npx dida365` installation method. 2. npm resolves the mutable `dida365` package from the configured registry. 3. An attacker has compromised that package, its maintainer account, or a transitive dependency, or the resolved package is not the intended `dida365-ai-tools` implementation. 4. npm downloads and executes package lifecycle or CLI code under the user's operating-system account. 5. The malicious code reads environment data, local files, shell configuration, cached credentials, or the Dida365 Cookie provided to the CLI. 6. The captured information can be transmitted to infrastructure controlled by the attacker or used to modify Dida365 account data. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user running `npx`. The accessible scope may inc ...[truncated 531 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Determine and document one canonical npm package name. Do not use `dida365` and `dida365-ai-tools` interchangeably unless their relationship is independently verified. 2. Pin an exact reviewed version, for example: ```bash npx --yes dida365-ai-tools@<reviewed-version> <command> [options] ``` 3. Publish and verify package provenance, maintainer identity, repository association, and integrity information. 4. Prefer installation through a lockfile-controlled project dependency instead of downloading a mutable package during each invocation. 5. Review direct and transitive dependencies and use automated dependency monitoring. 6. Where compatible with the package, disable npm lifecycle scripts during installation and explicitly run only reviewed entry points. 7. Document how users can verify that the installed binary originates from the intended package before providing authentication credentials. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:23
• Finding: Session Cookie Passed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 23 **Vulnerability Type**: Sensitive credential exposure through process arguments and command history **Risk Level**: High ### Vulnerable Code ```bash dida365 auth cookie <token> ``` ### Technical Analysis The documented authentication method places the Dida365 session Cookie directly in the command-line argument vector. Secrets supplied this way can be exposed through several local and operational channels: - Interactive shell history. - Process listings or operating-system process inspection interfaces. - Terminal session capture. - Debugging and observability tools that record command arguments. - CI/CD, automation, or AI-agent execution transcripts. - Wrapper scripts that log invoked commands. The document states that the CLI uses unofficial private Dida365 APIs. A reusable session Cookie may therefore grant broad access without the narrower scopes commonly associated with purpose-built API credentials. The documentation does not specify secure interactive input, redaction, restricted credential storage, expiration, or revocation procedures. ### Attack Path 1. A user obtains a valid Dida365 session Cookie. 2. The user runs `dida365 auth cookie <token>` as documented. 3. The shell stores the command in history, or a process monitor, terminal logger, automation platform, or agent transcript captures the argument. 4. Another local user, administrator, log reader, or compromised process retrieves the Cookie. 5. The attacker replays the Cookie against the CLI or the documented private Dida365 API endpoints. 6. Using the victim's session, the attacker reads account data or performs task, project, tag, folder, and batch operations available to that session. ### Impact Assessment A disclosed session Cookie could allow unauthorized access within the privileges of the authenticated Dida365 session. Based on the operations documented by the Skill, the affected scope may include: - Readin ...[truncated 545 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace command-line token input with hidden interactive prompting that does not echo or place the Cookie in the argument vector. 2. Support reading the credential from a protected file descriptor or standard input while ensuring that it is never logged. 3. If file-based credential storage is required, use an operating-system credential manager or an encrypted store. Apply restrictive permissions so only the owning user can read the credential. 4. Redact Cookies from application output, errors, debug logs, telemetry, and agent transcripts. 5. Warn users not to paste session Cookies into commands processed by shared terminals, automation logs, or conversational agents. 6. Document session revocation and credential-rotation procedures. 7. Prefer an official, scoped authorization mechanism over a general-purpose session Cookie whenever the required operations are supported. 8. Ensure destructive commands require explicit, non-bypassable confirmation and clearly display the affected resources before execution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The documentation instructs users to run the CLI via `npx dida365` without pinning a specific package version. That causes execution of whatever version is current in the registry at runtime, creating a supply-chain risk if a malicious or compromised release is published.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells users to supply a Cookie token for authentication but does not warn that this is a highly sensitive credential that may grant full account access. Users may expose the token through shell history, logs, screenshots, or shared terminals, leading to account compromise.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The `sync all` feature is documented as pulling all projects, tasks, tags, and folders, but there is no warning about the breadth of personal data collected or where that data may be displayed or stored. In an automation context this can lead to unintended exposure of sensitive task content, metadata, and organizational structure.

External Transmission

Medium

• Category: Data Exfiltration

Content

## 私有 API 端点参考

以下端点基于 `https://api.dida365.com/api/v2`，非官方，可能随时变更：

| HTTP | Endpoint | 功能 |
|------|----------|------|

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.