T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/index.js:509- Finding
Whitelist authorization is not bound to the actual document mutation target
- Content
View full analysis
- Remediation
View remediation
Security audit
dingtalk-doc
Security checks for vulnerabilities and agentic risk
Overview
This DingTalk document skill is mostly coherent, but it exposes high-impact write/delete powers with weak boundaries that should be reviewed before installation.
Install only if you trust the DingTalk app credentials and first replace the bundled whitelist with narrow, user-approved targets. Avoid using the low-level dingtalk-client.js commands, remove or disable get-token, and require explicit confirmation for overwrites and deletions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/dingtalk-client.js:610- Finding
Direct low-level client commands bypass mandatory whitelist enforcement
- Content
View full analysis
a.startsWith('--workspaceId='))?.split('=')[1]; const name = args.find(a => a.startsWith('--name='))?.split('=')[1]; const docType = args.find(a => a.startsWith('--docType='))?.split('=')[1]; const operatorId3 = args.find(a => a.startsWith('--operatorId='))?.split('=')[1]; const parentNodeId = args.find(a => a.startsWith('--parentNodeId='))?.split('=')[1]; if (!workspaceId2 || !name || !docType || !operatorId3) { throw new Error('缺少必填参数：--workspaceId=, --name=, --docType=, --operatorId='); } const createParams = { name: decodeCliValue(name), docType: docType, operatorId: operatorId3 }; if (parentNodeId) { createParams.parentNodeId = parentNodeId; } result = await createDoc(workspaceId2, createParams); break; ``` It also exposes document deletion directly: ```javascript case 'delete-doc': const workspaceId4 = args.find(a => a.startsWith('--workspaceId='))?.split('=')[1]; const nodeId2 = args.find(a => a.startsWith('--nodeId='))?.split('=')[1]; const operatorId6 = args.find(a => a.startsWith('--operatorId='))?.split('=')[1]; if (!workspaceId4 || !nodeId2 || !operatorId6) { throw new Error('缺少参数：--workspaceId=, --nodeId=, --operatorId='); } result = await deleteDoc(workspaceId4, nodeId2, operatorId6); break; ``` ### Technical Analysis The project states that all writes must pass the local whitelist and that there is no way to bypass the check. The primary `scripts/index.js` interface attempts to enforce that policy, but `scripts/dingtalk-client.js` is independently executable and provides raw creation and deletion commands. These ...[truncated 1667 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/dingtalk-client.js:570- Finding
Live DingTalk access token is exposed through standard output
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
config/whitelist.json:4- Finding
Distributed whitelist configuration enables workspace-wide destructive access by default
- Content
View full analysis
normalizePath(rule) === '/'); } ``` ```javascript if (hasWorkspaceWideWhitelist(wsConfig.whitelist)) { return { docPath, permission: { allowed: true, matchedRule: '/' }, wsConfig }; } ``` ### Technical Analysis The package ships with a concrete workspace identifier and a whitelist containing `/`. The code explicitly treats `/` as matching every node in the configured workspace. This conflicts with least-privilege and deny-by-default design. A user who installs or deploys the Skill without replacing the sample configuration may unknowingly enable creation, overwrite, block modification, and deletion across the complete configured workspace. Although the configuration comment says that only the user should edit the file, the distributed configuration is active and machine-readable rather than an inert example. ### Attack Path 1. Install or deploy the Skill without replacing `config/whitelist.json`. 2. The configured workspace is accessible to the DingTalk application. 3. A caller requests a write or deletion against any node in that workspace. 4. `hasWorkspaceWideWhitelist` recognizes `/` and immediately approves the operation. 5. The destructive DingTalk API call executes if upstream permissions allow it. ### Impact Assessment If the packaged workspace ID is valid in the deployment, the Skill receives local authorization to mutate every document in that workspace. Permitted actions include: - C ...[truncated 321 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
OpenClaw 会在启动时自动加载此文件中的环境变量。
bash # ~/.openclaw/.env DINGTALK_CLIENTID=dingxxxxxx DINGTALK_CLIENTSECRET=your_secret
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `POST /v1.0/doc/workspaces/{workspaceId}/docs` - `GET /v2.0/wiki/nodes` - `GET /v2.0/wiki/nodes/{nodeId}` - `DELETE /v1.0/doc/workspaces/{workspaceId}/docs/{nodeId}` - `GET /v1.0/doc/suites/documents/{docKey}/blocks` - `POST /v1.0/doc/suites/documents/{docKey}/overwriteContent` - `POST /v1.0/doc/suites/documents/{docKey}/blocks`
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md - `POST /v1.0/doc/suites/documents/{docKey}/overwriteContent` - `POST /v1.0/doc/suites/documents/{docKey}/blocks` - `PUT /v1.0/doc/suites/documents/{docKey}/blocks/{blockId}` - `DELETE /v1.0/doc/suites/documents/{docKey}/blocks/{blockId}` 常见所需权限：
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The top-level description presents the skill as a document read/update helper, but the body documents materially broader capabilities such as token acquisition, user identity resolution, create/delete operations, CLI execution, and potentially wider workspace management. This mismatch can cause reviewers or orchestrators to authorize the skill under a narrower trust model than its actual power warrants.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The top-level description presents the skill as a document read/update helper, but the body documents materially broader capabilities such as token acquisition, user identity resolution, create/delete operations, CLI execution, and potentially wider workspace management. This mismatch can cause reviewers or orchestrators to authorize the skill under a narrower trust model than its actual power warrants.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 通过钉钉开放平台 API 管理钉钉文档与钉钉知识库内文档。`SKILL.md` 只保留 agent 执行所需规则;配置细节、示例、API 背景见 `README.md`。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/index.js`:主入口
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/index.js`:主入口
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/index.js`:主入口
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `scripts/index.js`:主入口
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The deleteDoc primitive accepts workspaceId/nodeId/operatorId and directly constructs a destructive API request with no local authorization, confirmation, or constraint on what resources may be targeted. This is a classic high-risk tool surface for parameter abuse in agent systems, where attacker-influenced parameters can cause deletion of arbitrary accessible documents.
- Content
js /** * 删除知识库文档 (doc_1.0) * API: DELETE /v1.0/doc/workspaces/{workspaceId}/docs/{nodeId} */ async function deleteDoc(workspaceId, nodeId, operatorId) { const path = `/v1.0/doc/workspaces/${workspaceId}/docs/${nodeId}?operatorId=${encodeURIComponent(operatorId)}`;
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The deleteBlock primitive similarly accepts attacker-influenceable identifiers and issues a destructive API request without confirming the block belongs to the intended document context or that the user explicitly approved its removal. In an agent environment, this increases the chance of unauthorized or accidental content removal through parameter manipulation.
- Content
js /** * 删除块元素 * API: DELETE /v1.0/doc/suites/documents/{docKey}/blocks/{blockId} */ async function deleteBlock(docKey, blockId, operatorId) { const path = `/v1.0/doc/suites/documents/${docKey}/blocks/${blockId}?operatorId=${encodeURIComponent(operatorId)}`;
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 92% confidence
- Finding
The write authorization is bound to nodeId, but the actual destructive API call uses a caller-supplied docKey without verifying that the docKey belongs to the same document that was authorized. An attacker or confused caller could pass an allowed nodeId to satisfy whitelist checks and a different docKey for overwrite/delete/modify operations, potentially causing unauthorized writes or deletions against another accessible document.
- Content
js /** * 删除块元素（写入操作，需要白名单） * API: DELETE /v1.0/doc/suites/documents/{docKey}/blocks/{blockId} * * @param {string} nodeId - 节点 ID（用于白名单检查） * @param {string} blockId - 块 ID
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill relies on sensitive environment variables (
DINGTALK_CLIENTID,DINGTALK_CLIENTSECRET, sender identity fields) but does not declare an explicit tool scope or permissions boundary in the skill manifest. That weakens reviewability and increases the chance the agent accesses secrets or identity context more broadly than operators expect.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill documents destructive actions such as overwrite, block deletion, and document deletion without requiring explicit user confirmation or warning about irreversible data loss. In an agent setting, ambiguous or mistaken instructions could therefore lead to unintended destructive changes to production knowledge-base content.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file presents a contradictory security posture: a comment says AI must not modify the configuration, yet the actual policy grants broad write access via allowRootWrite=true and whitelist ['/'], effectively permitting writes anywhere in the workspace root. In the context of a document-management skill that can update DingTalk docs/knowledge-base content, this makes unauthorized or overbroad AI-driven modification materially more dangerous because a prompt mistake or adversarial instruction could alter arbitrary content in the allowed workspace.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill resolves sender IDs to unionId/operatorId by querying user profile/address-book APIs, adding identity lookup functionality unrelated to simple document handling. This increases access to organizational identity data and creates privacy and privilege risks if sender IDs are spoofed, mishandled, or logged, especially since operator identity is then reused to authorize downstream document actions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js /** * 获取 access_token（企业内部应用） * POST https://api.dingtalk.com/v1.0/oauth2/accessToken * * @returns {Promise<string>} 用于请求头 x-acs-dingtalk-access-token 的 accessToken */
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The client exposes destructive and administrative capabilities such as deleting documents, deleting blocks, copying nodes, and creating workspaces/docs, which go beyond the skill’s stated document read/summarize/update purpose. Scope expansion increases the blast radius if the skill is invoked unexpectedly or manipulated by prompt/tool misuse, because the process can perform irreversible changes rather than only read or summarize content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The overwriteContent operation replaces entire document contents without any user-facing warning, preview, or confirmation. Because it is a full overwrite rather than a bounded edit, misuse can cause large-scale data loss or tampering from a single call.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The block deletion primitive removes content with no confirmation or guardrails. In a document-management agent, low-friction destructive primitives are dangerous because they can be triggered by malformed instructions, parameter confusion, or prompt injection and may silently remove important content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI exposes document deletion directly with no confirmation, dry-run, or secondary approval step. In an agent skill context, this makes accidental, coerced, or prompt-injected destructive execution much more likely, and the action is potentially irreversible.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The script performs document deletion via
deleteDoc(...)after permission checks, but there is no confirmation prompt, user-facing warning, or log immediately before the irreversible action. Although the file comments describe delete capability, they do not clearly disclose at runtime that the command will permanently remove content.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The function deletes a document block through
deleteBlock(...), which is an irreversible content modification. The code includes permission checks but no confirmation prompt, no warning print/log, and no nearby user-facing disclosure that the targeted block content will be removed.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language comments and CLI output in Chinese, and the help/error interface shown to users is also fixed to Chinese later in the file. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the tool is clearly documented as region-specific, which is not evident here.
- Content