Security audit

钉钉日历

Security checks for vulnerabilities and agentic risk

Overview

This DingTalk calendar skill appears purpose-aligned but needs review because it can change organizational calendar and room bookings while its scope, dependencies, and confirmation expectations are under-specified.

Review before installing. Use it only for DingTalk calendar tasks, verify mcporter and the DingTalk protocol server are trusted and correctly configured, and require explicit user approval before creating, modifying, or booking calendar resources.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documented input schema advertises generic content-processing fields like `content`, `mode`, and `style`, but the skill actually performs DingTalk calendar operations that can create events and reserve meeting rooms. This mismatch can cause an agent or user to invoke the skill under false assumptions, leading to unintended state-changing actions without appropriate parameter validation or user consent.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The dependency section claims only an LLM API is required, while the examples and description rely on `mcporter` and a DingTalk protocol server. This concealment of real execution dependencies can mislead operators about the trust boundary, causing them to enable `exec` and external connectivity without understanding what software or services are actually being invoked.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The typical scenarios describe broad capabilities such as content generation, ETL, file batch processing, and environment management that are unrelated to a DingTalk calendar skill. Overbroad claims can cause an agent to route unrelated tasks into a skill that has `exec`, `read`, and `write` permissions, increasing the chance of inappropriate invocation and unintended side effects.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description includes a very broad activation cue like improving efficiency, automation, batch processing, and workflow optimization, which is not bounded to calendar use cases. In an agent environment, this can cause over-triggering for generic productivity requests and invoke a privileged skill in contexts where calendar access or command execution is unnecessary.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The invocation guidance says to call the skill in agent conversations with necessary parameters, but it does not define concrete trigger conditions, safety checks, or when user confirmation is required. Ambiguous routing guidance is risky for a skill that can execute commands and modify organizational calendar data.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill description emphasizes convenience and automation but does not clearly warn users that it can create or modify calendar entries and reserve shared meeting room resources. Without a prominent warning, users or orchestrators may treat it as informational rather than state-changing, increasing the likelihood of unintended modifications affecting other people and resources.

Static analysis

No suspicious patterns detected.