ClawHub
Back to skill

Security audit

dingtalk-send-media

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed DingTalk file-sending helper, not a hidden data stealer, but users should verify the file, recipient, and account before using it.

Install only if you want an agent to send local files through DingTalk. Before each use, confirm the exact file path, recipient or group ID, and DingTalk account, especially in multi-account environments. Avoid sending sensitive files unless necessary, use a least-privilege DingTalk app, and do not share unredacted environment or log output containing DINGTALK credentials.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_media.py:334
Finding

Bearer Access Token Exposed in the Media Upload URL

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
README.md:115
Finding

Troubleshooting Guidance May Print the DingTalk Client Secret

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

OpenClaw 会在启动时自动加载此文件中的环境变量。

bash
# ~/.openclaw/.env
DINGTALK_CLIENTID=dingxxxxxx
DINGTALK_CLIENTSECRET=your_secret
DINGTALK_ROBOTCODE=dingxxxxxx  # 可选，默认同 clientId

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 260)May include surrounding context.

md
- `未找到 OpenClaw 配置文件 openclaw.json`：当前无配置文件，需提供环境变量凭证或配置文件
- `未找到钉钉账号配置`：账号自动检测失败，需显式指定账号或补齐配置
- `获取 access token 失败`：检查 `clientId` / `clientSecret`
- `上传媒体文件失败`：检查文件路径、大小、媒体类型和上传权限
- `发送消息失败`：检查目标用户 ID / 群 ID、机器人权限和 `robotCode`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 263)May include surrounding context.

md
- `未找到 OpenClaw 配置文件 openclaw.json`：当前无配置文件，需提供环境变量凭证或配置文件
- `未找到钉钉账号配置`：账号自动检测失败，需显式指定账号或补齐配置
- `获取 access token 失败`：检查 `clientId` / `clientSecret`
- `上传媒体文件失败`：检查文件路径、大小、媒体类型和上传权限
- `发送消息失败`：检查目标用户 ID / 群 ID、机器人权限和 `robotCode`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md
- `未找到 OpenClaw 配置文件 openclaw.json`：当前无配置文件，需提供环境变量凭证或配置文件
- `未找到钉钉账号配置`：账号自动检测失败，需显式指定账号或补齐配置
- `获取 access token 失败`：检查 `clientId` / `clientSecret`
- `上传媒体文件失败`：检查文件路径、大小、媒体类型和上传权限
- `发送消息失败`：检查目标用户 ID / 群 ID、机器人权限和 `robotCode`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_media.py (reported line 285)May include surrounding context.

python
- `未找到 OpenClaw 配置文件 openclaw.json`：当前无配置文件，需提供环境变量凭证或配置文件
- `未找到钉钉账号配置`：账号自动检测失败，需显式指定账号或补齐配置
- `获取 access token 失败`：检查 `clientId` / `clientSecret`
- `上传媒体文件失败`：检查文件路径、大小、媒体类型和上传权限
- `发送消息失败`：检查目标用户 ID / 群 ID、机器人权限和 `robotCode`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_media.py (reported line 303)May include surrounding context.

python
- `未找到 OpenClaw 配置文件 openclaw.json`：当前无配置文件，需提供环境变量凭证或配置文件
- `未找到钉钉账号配置`：账号自动检测失败，需显式指定账号或补齐配置
- `获取 access token 失败`：检查 `clientId` / `clientSecret`
- `上传媒体文件失败`：检查文件路径、大小、媒体类型和上传权限
- `发送消息失败`：检查目标用户 ID / 群 ID、机器人权限和 `robotCode`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/send_media.py (reported line 486)May include surrounding context.

python
- `未找到 OpenClaw 配置文件 openclaw.json`：当前无配置文件，需提供环境变量凭证或配置文件
- `未找到钉钉账号配置`：账号自动检测失败，需显式指定账号或补齐配置
- `获取 access token 失败`：检查 `clientId` / `clientSecret`
- `上传媒体文件失败`：检查文件路径、大小、媒体类型和上传权限
- `发送消息失败`：检查目标用户 ID / 群 ID、机器人权限和 `robotCode`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README describes how to send local files to DingTalk but does not clearly warn users that the selected file contents and recipient identifiers will be transmitted to an external service. In an agent skill context, this omission can cause unintended data disclosure because a user may not realize that local screenshots, recordings, or attachments are leaving the host environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill instructs execution of a local Python script that can read local files, access environment/configured credentials, and send data over the network, but it declares no explicit tool scope or permissions boundary. That creates a confused-deputy risk: an agent may invoke file/network-capable behavior without a machine-readable restriction layer, increasing the chance of unauthorized file exfiltration to DingTalk if user intent or context is misinterpreted.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script reads ambient configuration and credential sources from the user's environment and home directory to discover DingTalk accounts, which expands its authority beyond the narrowly stated purpose of sending a user-specified local file to a clearly intended DingTalk conversation. In an agent setting, this can cause data to be sent using unintended accounts or hidden credentials without explicit user confirmation, increasing the risk of cross-account data leakage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The account-selection logic can derive the effective DingTalk account from OPENCLAW_ACCOUNT_ID, OPENCLAW_AGENT_ID, bindings, agent-name suffixes, connector defaults, and other runtime state rather than only from explicit operator intent. In a multi-account environment, this creates a real risk that sensitive files are transmitted through the wrong tenant, bot, or organizational context, which is especially dangerous for a file-sending skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_media.py (reported line 286)May include surrounding context.

python
def get_access_token(client_id, client_secret):
    """获取钉钉 access token"""
    url = "https://api.dingtalk.com/v1.0/oauth2/accessToken"
    data = json.dumps({
        'appKey': client_id,
        'appSecret': client_secret

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_media.py (reported line 360)May include surrounding context.

python
def get_access_token(client_id, client_secret):
    """获取钉钉 access token"""
    url = "https://api.dingtalk.com/v1.0/oauth2/accessToken"
    data = json.dumps({
        'appKey': client_id,
        'appSecret': client_secret

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_media.py (reported line 362)May include surrounding context.

python
def get_access_token(client_id, client_secret):
    """获取钉钉 access token"""
    url = "https://api.dingtalk.com/v1.0/oauth2/accessToken"
    data = json.dumps({
        'appKey': client_id,
        'appSecret': client_secret

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code uploads the specified local file to DingTalk and then sends it to a user or group via remote HTTP APIs, but the normal execution path provides no confirmation prompt or user-facing disclosure before transmission. Aside from debug-only output, there is no visible runtime warning about network transfer of potentially sensitive file data and recipient identifiers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The top-level natural-language documentation and usage descriptions in this file are written exclusively in Chinese, which imposes a specific language on users and maintainers without any opt-in or explanation. Under the stated policy, language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.