ClawHub
Back to skill

Security audit

dingtalk-doc-enterprise

Security checks for vulnerabilities and agentic risk

Overview

This skill openly performs user-directed read and edit operations on existing DingTalk documents and the inspected code matches that limited purpose.

Install only if you intend to let this skill use your DingTalk enterprise app credentials to read and change existing documents. Treat update and delete-block requests as potentially destructive, confirm the document and block target first, and avoid configuring the local debug operator ID in production.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Credential Access

High
Category
Privilege Escalation
Content
在 OpenClaw 环境中配置：

```bash
# ~/.openclaw/.env
DINGTALK_CLIENTID=dingxxxxxx
DINGTALK_CLIENTSECRET=your_secret
```
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High
Category
analysis-evasion
Content
使用同目录的 `doc-enterprise.js` 操作用户通过 URL 指定的已有钉钉文档。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
使用同目录的 `doc-enterprise.js` 操作用户通过 URL 指定的已有钉钉文档。
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
将相对路径按 `SKILL.md` 所在目录解析，并使用脚本绝对路径：
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Missing User Warnings

Medium
Confidence
89% confidence
Finding
This markdown file documents commands that can overwrite an entire document body and delete content blocks, which are safety-critical operations affecting user data. Although the capabilities are listed, there is no explicit warning or caution telling users these actions are destructive or should be confirmed before use.

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill requires access to environment secrets and networked API operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization-boundary weakness: the runtime may permit broader capabilities than reviewers or policy systems can easily verify, making secret use and outbound calls less transparent and harder to constrain. In this context, the skill edits enterprise DingTalk documents on behalf of a user, so undeclared capability scope increases the risk of unintended data access or modification if the skill is invoked incorrectly or extended unsafely.

Static analysis

No suspicious patterns detected.