dingtalk-aitable
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes multiple Python scripts (scripts/bulk_add_fields.py, scripts/aitable_export_via_task.py, scripts/upload_attachment.py, scripts/aitable_import_via_task.py, and scripts/import_records.py) to execute dws CLI commands via subprocess.run. This is a core functional requirement for the skill to interact with the DingTalk ecosystem and is implemented using static command roots.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external data from CSV, JSON, and Excel files.
- Ingestion points: scripts/import_records.py (CSV/JSON), scripts/bulk_add_fields.py (JSON), and scripts/aitable_import_via_task.py (XLSX/CSV/XLS) ingest user-supplied files.
- Boundary markers: The skill relies on specific instructions in SKILL.md to guide agent behavior and formatting when processing external data.
- Capability inventory: The skill can execute shell commands via the dws CLI and perform file system read/write operations.
- Sanitization: Scripts implement path validation using a resolve_safe_path helper to prevent path traversal and verify file extensions before processing content.
- [EXTERNAL_DOWNLOADS]: The skill performs network operations using urllib.request.urlopen in scripts/upload_attachment.py, scripts/aitable_export_via_task.py, and scripts/aitable_import_via_task.py to handle file uploads to OSS and downloads of exported data. These operations target transient URLs generated by the official CLI tool for functional purposes.
Audit Metadata