The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: In src/stream_bot.py, the execute_prompt function accepts message content directly from DingTalk WebSocket callbacks and executes it using subprocess.run. The command invocation includes the --dangerously-skip-permissions flag, which explicitly disables Claude's security guardrails and permission prompts. Because the bot processes mentions from any user in a connected group without authentication, this provides a direct path for remote attackers to execute arbitrary shell commands on the system running the bot.
[DATA_EXFILTRATION]: The skill facilitates data exfiltration by sending the output of executed commands back to the DingTalk group via the send_markdown function in src/send.py. Furthermore, the reply_via_webhook function in src/send.py uses a sessionWebhook URL provided dynamically in the DingTalk callback. An attacker could potentially supply a malicious URL to redirect command output or sensitive system information to an external server under their control.
[COMMAND_EXECUTION]: The scripts/install.sh script creates a macOS LaunchAgent (com.dingtalk-bridge.bot) to ensure the bot runs persistently. This configuration causes the vulnerable bot to start automatically at login and restart upon failure, maintaining a persistent remote entry point on the user's machine.
[EXTERNAL_DOWNLOADS]: The installer in scripts/install.sh uses pip3 to download and install the dingtalk_stream and websockets packages. These installations are performed without version pinning or integrity verification (such as hashes), which exposes the user to supply chain risks if the upstream packages are compromised.
[PROMPT_INJECTION]: The bot is vulnerable to indirect prompt injection. It ingests untrusted text from a remote chat and interpolates it directly into the agent's execution context. A malicious participant could send a message designed to hijack the agent's instructions, potentially causing it to perform actions outside the intended scope of the DingTalk bridge.

dingtalk-bridge