Dingtalk Bot Publish

• Analyzed: May 15, 2026, 4:54 AM
• Findings: 1
• Version: 1.0.0
• Hash: 22f474ec031764c6e76f2bcff77590954c6a68fc2c25581a97d00c18d87304ab
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a vulnerability where the `access_token` is passed in URL query parameters for several DingTalk API calls (e.g., in `scripts/get-department.ts`, `scripts/get-user.ts`, `scripts/list-department-users.ts`, etc.). This practice can lead to sensitive credential exposure in server access logs, browser history, or referrer headers, which is an information leakage vulnerability. While there is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, arbitrary code execution, or persistence mechanisms, this significant security flaw warrants a 'suspicious' classification. Additionally, the `scripts/stream-bridge.py` file is a placeholder and does not implement the described 'Stream mode' functionality, indicating a functional gap, though not a security risk.