Security checks for vulnerabilities and agentic risk
Overview
This DingTalk calendar skill is mostly coherent in purpose, but its routing text, privacy claims, install instructions, and diagnostic commands create enough ambiguity and risk that users should review it before installing.
Install only if you are comfortable granting an agent command-line access to a third-party DingTalk calendar CLI that can create, update, delete, and book calendar items. Correct the routing text to DingTalk calendar use only, pin and verify the mcporter package, remove the --force install fallback, avoid broad environment-variable listing, and require explicit confirmation before updates, deletes, or room bookings.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
Location
SKILL.md:151
Finding
Unpinned Global Installation of a Third-Party CLI Package
Content
View full analysis
Vulnerability Details
File Location: SKILL.md:151-154, SKILL.md:189-192, and SKILL.md:237 Vulnerability Type: Supply-chain exposure through an unpinned global npm dependency Risk Level: Medium
The same installation and configuration sequence is repeated at lines 189-192. The troubleshooting instructions at line 237 additionally recommend:
bash
npm install -g mcporter --force
Technical Analysis
The Skill instructs the agent to install the latest available version of the mcporter npm package globally. It does not specify an exact reviewed version, provide a lockfile, verify package integrity, or document a trusted package provenance check.
npm packages can execute lifecycle scripts during installation. Consequently, the installed package and its transitive dependencies can execute code with the permissions of the user running npm. Because the requested version is mutable, the code executed during a future Skill installation may differ from the code that existed when this Skill was audited.
The suggested --force option further weakens installation safeguards and can cause npm to proceed despite protections or dependency conditions that would otherwise block the installation.
No evidence establishes that the named package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution process.
Attack Path
An attacker compromises the npm package, one of its transitive dependencies, or the associated publisher account.
The attacker publishes a malicious release or modifies package lifecycle behavior.
A user activates the Skill and follows its setup instructions.
npm install -g mcporter resolves the current package relea
...[truncated 1128 chars]
Remediation
View remediation
Remediation Suggestions
Pin mcporter to an exact, reviewed version instead of resolving the latest release:
bash
The validation procedure searches the entire process environment for variable names containing generic credential-related terms.
The Linux/macOS command masks values after collecting them, but it still discloses the names and presence of unrelated credentials to command output. Broad enumeration is unnecessary when the Skill should know the exact variables it requires.
The documented PowerShell alternative is more severe. Get-ChildItem Env: returns environment entries with both names and values, and Format-Table normally renders those fields. Unlike the Unix pipeline, this command contains no redaction stage. API keys or tokens may therefore be printed in plaintext.
When executed by an AI agent, command output can be captured in tool results, conversation history, diagnostic logs, terminal scrollback, or external platform telemetry. The file does not contain evidence that the values are intentionally transmitted to an attacker, but the instructions create an avoidable disclosure channel.
Attack Path
A Windows user has API keys, access tokens, or other secrets stored in environment variables.
The user or agent follows the Skill's configuration-validation instructions.
PowerShell executes Get-ChildItem Env: and filters names matching API, KEY, or TOKEN.
Format-Table prints the matching environment entries, including their values.
The plaintext values become visible in terminal output and potentially in the
...[truncated 1029 chars]
Remediation
View remediation
Remediation Suggestions
Remove broad enumeration of the complete environment.
Define the exact environment-variable names required by the Skill and test only whether each one exists.
Return only a Boolean or status message; never print the value:
powershell
if (Test-Path Env:REQUIRED_VARIABLE) {
Write-Output "REQUIRED_VARIABLE is configured"
} else {
Write-Output "REQUIRED_VARIABLE is not configured"
}
Apply equivalent set/unset checks on Linux and macOS without invoking env:
bash
if [ -n "${REQUIRED_VARIABLE:-}" ]; then
printf '%s\n' 'REQUIRED_VARIABLE is configured'
else
printf '%s\n' 'REQUIRED_VARIABLE is not configured'
fi
Prevent command output containing secrets from entering agent context, telemetry, or persistent logs.
If a secret has already been printed, remove affected logs where possible and rotate the credential immediately.
Add automated tests or linting rules that reject diagnostic commands capable of rendering secret values.
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Description-Behavior Mismatch
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
The manifest description directs agents to use this skill for database operations, SQL queries, and data storage management, but the actual content implements DingTalk calendar and contacts actions. This scope mismatch can cause the skill to be invoked in unrelated contexts and grant exec-capable calendar/network actions where users expected database behavior, increasing the risk of unintended external actions and data exposure.
Content
No source excerpt is available for this finding.
Vague Triggers
High
Category
Not specified by scanner
Confidence
98% confidence
Finding
The manifest gives broad invocation guidance that conflicts with the tool’s calendar purpose, which is especially risky because manifest metadata often drives automatic tool selection. A mislabeled exec-enabled skill can be chosen for database or storage tasks and then execute unrelated commands or send data to DingTalk services, violating user intent and least-privilege expectations.
Content
No source excerpt is available for this finding.
Vague Triggers
High
Category
Not specified by scanner
Confidence
97% confidence
Finding
The trigger description is overly broad and mismatched to the skill’s actual calendar scope, making accidental invocation more likely. In an AI-agent setting, poor scoping is dangerous because it can route unrelated user tasks into an exec-capable skill that may perform external side effects against calendars, contacts, or room-booking systems.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
High
Category
Not specified by scanner
Confidence
96% confidence
Finding
The skill claims that all data is stored locally and not uploaded to the cloud, yet elsewhere it explicitly depends on external APIs, network connectivity, and remote DingTalk endpoints. This misleading privacy claim can cause users or agents to handle sensitive scheduling, attendee, and contact data under false assumptions about data residency and transmission.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The file states that the skill covers '中文交互' as a core capability, and the manifest description also emphasizes Chinese-only interaction, but it does not offer language choice or indicate user opt-in. This may violate language/locale policy where skills should not force a specific language by default.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The skill advertises update and delete calendar operations without any stated confirmation, preview, or undo requirement. In an autonomous or semi-autonomous agent workflow, destructive actions without explicit safeguards can lead to accidental deletion or modification of meetings, participant lists, and reserved rooms.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The trigger text says to use the skill for data analysis, report generation, statistical insight, and visualization, which does not match the documented calendar-management behavior. Overbroad routing instructions can cause an agent to select this exec-enabled skill for requests outside its safe scope, leading to unintended command execution or unnecessary access to calendar/contact systems.
