Security audit

钉钉日历基础版

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a real DingTalk calendar helper, but its routing text, privacy claims, and mutation guidance are inconsistent enough that users should review it before installing.

Install only if you intend to use it for DingTalk calendar, room, free/busy, and contact workflows. Review the mcporter package and DingTalk endpoint configuration first, avoid storing secrets in plaintext config where possible, and require explicit confirmation before event updates, deletions, or room bookings. Do not rely on the database/SQL or data-analysis trigger language as an accurate description of this skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest description says the skill should be used for database operations, SQL queries, and data storage, while the actual content operates on DingTalk calendar and contacts. This mismatch can cause an agent to invoke the skill in the wrong context and grant exec-powered access for unrelated tasks, increasing the risk of unintended actions on calendars, contacts, or external services.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill claims data is stored locally and not uploaded to the cloud, but elsewhere it documents external API calls and required network access. This can mislead users and agents about where sensitive calendar, attendee, and contact data may be transmitted, undermining informed consent and privacy expectations.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation both allows API key storage in configuration files and warns against placing secrets in configuration files. Conflicting secret-handling guidance leads to insecure operator behavior and increases the chance that API keys or tokens will be persisted in plaintext and later exposed through local files, backups, or source control.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger conditions say to use the skill for data analysis, report generation, statistics, and visualization, which does not match the calendar-management behavior described elsewhere. Overbroad and inconsistent routing criteria can cause an agent to call an exec-capable skill for tasks outside its intended domain, creating unnecessary exposure to destructive or privacy-impacting operations.

Vague Triggers

High

Confidence: 97% confidence
Finding: The manifest description contains conflicting and vague invocation guidance, mixing DingTalk calendar management with unrelated database/SQL/storage use cases. In an agent ecosystem, manifest metadata is often used for discovery and routing, so inaccurate metadata can directly increase the chance of inappropriate invocation and unsafe execution.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill supports updating and deleting calendar events but does not warn about destructive effects or recommend confirmation before modifying existing records. In an agent-driven workflow, this omission can lead to accidental event loss, incorrect schedule changes, or unauthorized modifications with immediate operational impact.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill exposes operations for querying other people's free/busy status and searching contacts without presenting a privacy or authorization warning. These features can reveal sensitive organizational presence, attendee patterns, and directory data, especially when used by an autonomous agent with broad execution privileges.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.