ClawHub
Back to skill

Security audit

钉钉宜搭开发助手

Security checks for vulnerabilities and agentic risk

Overview

This Yida development guide is coherent, but it needs review because it teaches remote script loading and business data automation without enough safety boundaries.

Review this skill before installing if you will use its snippets in real Yida apps. Only load JavaScript from fully trusted, controlled origins; avoid leaving debugging scripts in production; test OpenAPI and automation flows in a sandbox; scope update/delete operations narrowly; and treat webhook or AI integrations as third-party data sharing that may require privacy review.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (3)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:475
Finding

Unverified Remote Debugging Script Executes in the Yida Page Context

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:475-479
Vulnerability Type: Runtime retrieval and execution of externally hosted JavaScript
Risk Level: Medium

Complete Code Snippet:

js
const vConsole = 'https://g.alicdn.com/code/lib/vConsole/3.11.2/vconsole.min.js';
const js = document.createElement('script');
js.src = vConsole;
document.body.append(js);
js.onload = function() { window.vConsole = new window.VConsole(); };

Technical Analysis

The Skill recommends creating a script element and loading vConsole directly from an external CDN. The version is pinned and the CDN belongs to the ecosystem associated with the declared platform, so this is not evidence of an intentionally malicious payload. However, the script is executed without an integrity hash, authenticity verification, local vendoring, or an enforced origin policy.

Remote JavaScript loaded this way executes with the privileges of the Yida page. Its effective behavior can change after the Skill has been reviewed if the hosted asset, CDN publishing account, DNS path, or delivery infrastructure is compromised. Loading a debugging console is also not required for the Skill's ordinary form-development functionality and should therefore be an explicitly optional, development-only capability.

Attack Path

  1. A developer copies the documented snippet into a Yida action panel.
  2. A user opens the resulting page, causing the browser to request the script from the external CDN.
  3. An attacker who has compromised the hosted asset or its delivery path substitutes modified JavaScript.
  4. The browser executes that modified script in the active page context.
  5. The script can inspect page-accessible form values, application state, user information, local storage, and authenticated API capabilities.
  6. It can alter page behavior or transmit accessible information to an attacker-controlled endpoint.

This path is conditional on compro ...[truncated 565 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer a platform-provided debugging facility or a locally vendored and reviewed copy of vConsole.
  • If remote loading is unavoidable, verify the exact artifact against a pinned cryptographic checksum before execution.
  • Use Subresource Integrity with an appropriate crossorigin policy where supported.
  • Enforce a restrictive Content Security Policy and an explicit allowlist of approved script origins.
  • Mark the snippet as development-only and require its removal before production deployment.
  • Do not load the debugger on pages containing sensitive production data.
  • Document that remote scripts inherit the page's privileges and must never be loaded from a user-controlled URL.

T03 · Remote Payload Retrieval and Execution

Warning
Location
references/troubleshooting.md:35
Finding

Duplicated Remote vConsole Injection Lacks Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: references/troubleshooting.md:35-40
Vulnerability Type: Runtime retrieval and execution of externally hosted JavaScript
Risk Level: Medium

Complete Code Snippet:

js
const vConsole = 'https://g.alicdn.com/code/lib/vConsole/3.11.2/vconsole.min.js';
const js = document.createElement('script');
js.src = vConsole;
document.body.appendChild(js);
js.onload = function() { 
  window.vConsole = new window.VConsole(); 
};

Technical Analysis

The troubleshooting guide repeats the remote script-injection pattern from the primary Skill instructions. Although the URL is HTTPS, version-pinned, and hosted on an ecosystem-related CDN, transport encryption alone does not guarantee that the delivered file is the reviewed artifact.

The code provides no integrity check or environmental restriction. Consequently, a compromised upstream asset can execute arbitrary JavaScript with the Yida page's authority. Including the example in troubleshooting guidance may also encourage developers to leave a powerful debugging tool enabled in production.

Attack Path

  1. A developer follows the mobile-debugging instructions and deploys the snippet.
  2. Each affected page load retrieves vConsole from the external CDN.
  3. A compromised CDN resource, publishing account, DNS route, or delivery path returns altered JavaScript.
  4. The browser executes the altered payload as trusted page code.
  5. The payload reads or changes page-accessible data and may perform authenticated requests or send collected data elsewhere.

Exploitation depends on external resource compromise or substitution. The audited guide itself does not contain an exfiltration payload.

Impact Assessment

A successful attack could compromise data and operations exposed to the affected page, including form contents, application state, local storage, user details, and page-authorized API calls. The privileges obt ...[truncated 107 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace runtime CDN injection with a reviewed, locally controlled debugging asset.
  • Add cryptographic artifact verification or Subresource Integrity where platform support permits.
  • Restrict debugging code to development tenants and non-production data.
  • Add a build or publication check that rejects deployed pages containing vConsole.
  • Apply a Content Security Policy allowing scripts only from explicitly approved origins.
  • Include a prominent warning describing the page-level privileges inherited by externally loaded scripts.

T03 · Remote Payload Retrieval and Execution

Warning
Location
references/js-api.md:268
Finding

API Documentation Encourages Arbitrary External Script Loading Without Trust Controls

Content
View full analysis

Vulnerability Details

File Location: references/js-api.md:268-275
Vulnerability Type: Unrestricted remote script-loading example
Risk Level: Medium

Complete Code Snippet:

js
// Dynamic JS loading
this.utils.loadScript('https://example.com/script.js', () => {
  console.log('Loaded');
});

// Dynamic CSS loading
this.utils.loadStyle('https://example.com/style.css');

Technical Analysis

The API reference demonstrates loading JavaScript from an arbitrary external URL without requiring an origin allowlist, integrity verification, scheme validation, or a prohibition against user-controlled URLs. The displayed example.com address is a placeholder and is not an identified malicious destination. The risk comes from the unsafe usage pattern that developers may adapt to untrusted locations.

loadScript introduces a code-execution boundary: the downloaded resource runs in the calling page's browser context. If an application constructs this URL from form values, query parameters, remote configuration, or another attacker-influenced source, an attacker may be able to select the code that the page executes. Even with a fixed URL, compromise of the selected third-party host can change the effective payload after review.

The CSS example does not execute JavaScript by itself under normal browser behavior, but untrusted styles can still manipulate the interface, conceal warnings, or create deceptive overlays. The primary confirmed code-execution concern is loadScript.

Attack Path

  1. A developer copies the documented loadScript pattern.
  2. The placeholder is replaced with an unreviewed third-party URL, or the URL is derived from attacker-influenced input.
  3. The page retrieves the selected JavaScript at runtime.
  4. The external server returns malicious or subsequently compromised code.
  5. The browser executes that code with access to the Yida page's JavaScript environment.
  6. The payloa ...[truncated 663 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace the generic example with a fixed, approved-domain example and explain the required trust model.
  • Require an explicit allowlist of script origins and reject all other hosts.
  • Require HTTPS and reject URLs derived from form values, URL parameters, or other untrusted input.
  • Prefer bundled or locally hosted dependencies that can be reviewed and version-controlled.
  • Verify downloaded artifacts using cryptographic hashes or Subresource Integrity where possible.
  • Deploy a restrictive Content Security Policy that prevents execution from unauthorized origins.
  • Add explicit documentation that loadScript grants the downloaded resource full page-level JavaScript privileges.
  • Treat remotely loaded CSS as untrusted content and restrict style origins to prevent interface spoofing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase set includes very broad terms such as “宜搭”, “yida”, and “低代码开发”, which are likely to appear in ordinary discussion, troubleshooting, or comparison contexts rather than as explicit requests to invoke this skill. Over-broad activation can cause the skill to engage unexpectedly, increasing the chance that it injects domain-specific instructions or schema/code generation into unrelated conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document promotes external webhook, Open API, and AI-node integrations but does not warn that business data may be transmitted to external services or AI systems. In a low-code automation assistant, users may copy these patterns directly and unintentionally expose personal, workflow, or approval data to third parties without assessing privacy, consent, retention, or cross-boundary transfer risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples show automated record updates and synchronization but do not warn that automation can modify production business records at scale, including incorrect status, assignee, or timestamp values. In this skill context, users are likely to operationalize these examples directly, increasing the chance of unintended data corruption or workflow side effects if triggers, filters, or mappings are wrong.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly demonstrates loading arbitrary remote JavaScript and CSS via this.utils.loadScript() and this.utils.loadStyle() without any warning about trust boundaries, integrity validation, or the risks of executing third-party code in the application context. In a low-code development assistant, this can normalize unsafe patterns that lead to XSS, data exfiltration, session abuse, or supply-chain compromise if users copy the example with untrusted URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file includes task deletion logic and later a bulk 'clear completed' action, but the tutorial text provides no warning that these actions remove user data and offers no recommendation for confirmation or undo. Under the markdown-specific missing-warning rule, user-facing descriptions should warn about behaviors that affect data integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The tutorial's advanced section moves from local storage to remote API endpoints and transmits task content to backend form APIs, but the document does not warn users that their todo data will be stored remotely. For markdown files, behaviors affecting privacy or data handling should be disclosed clearly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guide instructs users to dynamically load and execute a third-party script from a remote CDN inside the application context. Even though this is presented as a debugging aid, it introduces supply-chain and script-injection risk because the code runs with the same privileges as the page and no warning, integrity check, or trust-boundary guidance is provided.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest description states the skill is for Yida low-code development, but it does not define boundaries for when it should not activate, such as general JavaScript questions, generic API integration, or non-Yida DingTalk topics. Without exclusions, the routing layer may select this skill in ambiguous cases, causing inappropriate domain assumptions and increasing the risk of misapplied instructions or irrelevant code suggestions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file presents all instructions and examples exclusively in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language is provided. The document does not indicate that it is intentionally region-specific or that users may choose another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The entire skill document is presented in Chinese, and there is no indication that the skill is intentionally limited to Chinese-speaking users or a specific region. Under the stated policy, forcing a specific language without user opt-in or documented justification can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

A natural-language policy issue applies because the skill content appears to force a specific language for all users. There is no indication that the document is region-specific or that users can access an alternative language version.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.