DingTalk Channel Setup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:07 AM UTC
• Version: 1.0.0

Overview

This DingTalk setup skill is mostly purpose-aligned, but it asks users to install an unpinned third-party plugin and handle DingTalk secrets in ways that deserve review before use.

Review the plugin source and install a pinned, trusted version where possible. Treat any DingTalk Client Secret as sensitive: avoid passing it on the command line, restrict permissions on ~/.openclaw/openclaw.json, rotate the example-looking secret if it was ever real, and back up your OpenClaw config before running the automation script.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Third-Party Plugin Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:37-55; also present at SKILL.md:272 and README.md:16-18
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

**Domestic network environment (mirror recommended):**

```powershell
$env:NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
openclaw plugins install @soimy/dingtalk

International network:

bash

openclaw plugins install @soimy/dingtalk

When a proxy is required:

powershell

$env:HTTP_PROXY="http://127.0.0.1:7897"
$env:HTTPS_PROXY="http://127.0.0.1:7897"
openclaw plugins install @soimy/dingtalk

text

The automated setup repeats the same installation behavior:

```powershell
# Install plugin
Write-Host "Installing plugin..." -ForegroundColor Yellow
openclaw plugins install @soimy/dingtalk

Technical Analysis

The installation commands identify the package only by name and do not specify a reviewed version, immutable artifact digest, integrity hash, or signature. Consequently, the code installed when a user follows the instructions can differ from the code that existed when this skill was audited.

Some instructions also direct users to resolve the package through the third-party registry.npmmirror.com registry mirror. This adds another trust boundary: the installed artifact depends on both the package publisher and the selected registry infrastructure.

This does not prove that the current @soimy/dingtalk package or registry is malicious. The vulnerability is the absence of controls that would prevent a future compromised, substituted, or unexpectedly updated package from being installed and enabled.

Attack Path

1. An attacker compromises the package publisher account, upstream package, or package-distribution infrastructure.
2. The attacker publishes a malicious release under the existing @soimy/dingtalk package ...[truncated 1057 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specifically reviewed version instead of installing the moving latest release, for example:

   bash

   openclaw plugins install @soimy/dingtalk@<reviewed-version>
   

2. Record and verify an integrity digest or cryptographic signature for the expected package artifact where the plugin manager supports this.
3. Prefer the official package registry. If a mirror is operationally required, document its trust assumptions and independently verify artifact integrity.
4. Use a lockfile or equivalent immutable dependency manifest for automated deployments.
5. Review the plugin source and package contents before updating the pinned version.
6. Run the OpenClaw gateway under a dedicated, least-privileged account with restricted filesystem and network access to reduce the effect of a compromised plugin.
7. Establish an explicit update process that tests and approves new plugin versions before deployment.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:119

Finding

DingTalk Credentials Are Handled as Plaintext and Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:119-133, SKILL.md:238-315, and SKILL.md:326-336
Vulnerability Type: Plaintext secret storage and command-line credential exposure
Risk Level: Medium

Vulnerable Code

The complete configuration example contains a realistic secret-like value:

json

{
  "id": "dingtalk",
  "plugin": "dingtalk",
  "enabled": true,
  "clientId": "ding3ti4ahg82dsfkwld",
  "clientSecret": "FrpMFcI30c0STvaJJWyMSZoyeb2Hkm9YqXY-6mJ0dGwdN8Xux7mgT_Xn7qnpvO-F",
  "robotCode": "your_robot_code",
  "corpId": "your_corp_id",
  "agentId": "your_agent_id",
  "aiCard": false,
  "dm": "open",
  "group": "open"
}

The automated setup accepts the secret as an ordinary string parameter and writes it directly to the configuration file:

powershell

param(
    [Parameter(Mandatory=$true)]
    [string]$ClientId,
    
    [Parameter(Mandatory=$true)]
    [string]$ClientSecret,
    
    [string]$RobotCode = "",
    [string]$CorpId = "",
    [string]$AgentId = "",
    [string]$ProxyUrl = "http://127.0.0.1:7897",
    [string]$NpmRegistry = "https://registry.npmmirror.com",
    [switch]$UseProxy = $false
)

powershell

$dingtalkConfig = @{
    id = "dingtalk"
    plugin = "dingtalk"
    enabled = $true
    clientId = $ClientId
    clientSecret = $ClientSecret
    dm = "open"
    group = "open"
}

if ($RobotCode) { $dingtalkConfig.robotCode = $RobotCode }
if ($CorpId) { $dingtalkConfig.corpId = $CorpId }
if ($AgentId) { $dingtalkConfig.agentId = $AgentId }

$config.channels = @($config.channels | Where-Object { $_.id -ne "dingtalk" })
$config.channels += $dingtalkConfig

$config | ConvertTo-Json -Depth 10 | Set-Content $configPath

The documented invocation places credentials directly on the command line:

powershell

# Basic usage
.\auto-setup.ps1 -ClientId "your_id" -ClientSecret "your_secret"

# Use 
...[truncated 2788 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the realistic secret-like value with an unmistakable placeholder such as REPLACE_WITH_DINGTALK_CLIENT_SECRET.
2. Immediately determine whether the documented value is genuine. If it is or may have been active, revoke and rotate it, then review DingTalk access logs for misuse.
3. Do not accept the secret through a normal command-line argument. Prompt interactively without echoing it, retrieve it from an approved secret manager, or use a protected credential object.
4. Avoid storing the secret directly in general-purpose JSON where OpenClaw supports environment-variable references, operating-system credential stores, or external secret providers.
5. If plaintext storage is unavoidable, create the configuration file with an owner-only ACL and verify that inherited permissions do not grant access to unrelated users or groups.
6. Ensure deployment systems redact the secret from transcripts, CI/CD logs, diagnostic bundles, and error output.
7. Document credential rotation procedures and use the minimum DingTalk application scopes necessary for the bot.
8. Add automated secret scanning to the repository and release process to prevent future credential-like values from being committed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The optional automation script accepts sensitive credentials, writes them into ~/.openclaw/openclaw.json, and restarts the gateway, but the documentation does not clearly warn users that secrets will be stored in plaintext on disk and that an existing live configuration will be modified. In this context the behavior is relevant to setup, but it still increases the risk of credential exposure, accidental configuration overwrite, and unintended service changes on the local host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Natural-language policy requires avoiding forced language or locale constraints unless users are given a choice or the restriction is justified. This file mixes some English headings with predominantly Chinese operational guidance, but it does not tell users that the skill is Chinese-only or offer an alternative language path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.