huo15-dingtalk-agent-isolation

• Outcome: Review
• Latest audit: Aug 1, 2026 · 8:03 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for DingTalk agent isolation, but it asks users to patch connector code and enable automatic persistent OpenClaw config changes with weaker safeguards than the documentation claims.

Review this skill before installing. Prefer manual binding mode unless you need automatic onboarding. If enabling dynamic mode, set a strict maxAgents value, keep backups of ~/.openclaw/openclaw.json, and understand that first-time DingTalk direct messages can add persistent agents and bindings. Avoid copy-pasting the rm -rf cleanup commands without verifying the exact resolved path.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs users to read and modify local files such as `~/.openclaw/openclaw.json`, create directories, and apply patches, but it declares no corresponding permissions. This creates a trust and transparency gap: an agent or operator may perform filesystem operations without an explicit permission model, increasing the risk of unintended file modification in a privileged local environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill includes destructive deletion commands (`rm -rf`) in operational guidance without strong warnings, validation steps, or safer alternatives. Even though the paths are examples, copy-paste use in a real shell can cause irreversible data loss if the variables, home directory expansion, or path editing are wrong.

Missing User Warnings

Medium

• Confidence: 73% confidence
• Finding: The patch explicitly performs direct read/modify/write of ~/.openclaw/openclaw.json without any locking or atomic update mechanism, while also creating directories based on runtime-triggered messages. In a concurrent bot environment, simultaneous first-contact events can race, causing lost updates, duplicated bindings, config corruption, or inconsistent authorization routing for agents.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. 从 `openclaw.json` 的 `agents.list` 中移除对应条目
2. 从 `bindings` 中移除对应的 binding
3. 删除工作空间目录: `rm -rf ~/.openclaw/workspace-dingtalk-userA`
4. 删除 Agent 目录: `rm -rf ~/.openclaw/agents/dingtalk-userA`
5. 重启 OpenClaw

• Confidence: 78% confidence
• Finding: rm -rf ~/.openclaw/workspace-dingtalk-userA` 4. 删除 Agent 目录: `rm -rf ~

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. 从 `openclaw.json` 的 `agents.list` 中移除对应条目
2. 从 `bindings` 中移除对应的 binding
3. 删除工作空间目录: `rm -rf ~/.openclaw/workspace-dingtalk-userA`
4. 删除 Agent 目录: `rm -rf ~/.openclaw/agents/dingtalk-userA`
5. 重启 OpenClaw

• Confidence: 78% confidence
• Finding: rm -rf ~/.openclaw/

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

1. 从 `openclaw.json` 的 `agents.list` 中移除对应条目
2. 从 `bindings` 中移除对应的 binding
3. 删除工作空间目录: `rm -rf ~/.openclaw/workspace-dingtalk-userA`
4. 删除 Agent 目录: `rm -rf ~/.openclaw/agents/dingtalk-userA`
5. 重启 OpenClaw

### Q5: 动态创建的 Agent 会共享公共技能吗？

• Confidence: 96% confidence
• Finding: rm -rf ~/.openclaw/agents/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:408