Dingtalk Api

• Analyzed: May 11, 2026, 4:48 AM
• Findings: 1
• Version: 0.0.1
• Hash: 59e4f3875195477f20aef883a0f64ac7a6380c610c8ba61aaf18153ba1ba079f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to critical vulnerabilities found within the `dingtalk_stream` SDK, specifically in `venv/dingtalk_venv/lib/python3.12/site-packages/dingtalk_stream/chatbot.py` and `card_replier.py`. The `reply_rpa_plugin_card` method in `chatbot.py` is vulnerable to client-side script injection (XSS) as it directly embeds unsanitized `plugin_name` and `ability_name` into a JavaScript string executed by the DingTalk client. Additionally, the `create_and_deliver_card` methods in `card_replier.py` accept arbitrary `**kwargs` that are merged into the API request body, potentially allowing unauthorized API parameter injection. While the skill bundle itself does not exhibit clear malicious intent, these vulnerabilities present significant attack vectors if an adversary can control the inputs to these functions.