dingtalk-bridge

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub repository URLs point to a community repo that the project instructs users to clone and run an unpinned installer which can install a persistent LaunchAgent and executes arbitrary prompts/CLI commands — making that download source capable of distributing malicious or abuse-prone code if the repo is untrusted.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository exposes functionality that can be abused for remote code execution and data exfiltration: it accepts untrusted DingTalk mentions and executes them via the Claude CLI with a permissions-bypass flag, can post outputs to dynamic webhooks, and the installer can install a persistent LaunchAgent—together enabling remote-triggered execution and possible secret/data leakage.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In src/stream_bot.py, the DingTalk Stream callback handler extracts untrusted incoming chat text (callback.data...content) and passes it directly to execute_prompt(), which runs subprocess.run([claude_bin, "-p", prompt, ...]) with --dangerously-skip-permissions.