dingtalk-mail
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts to run the dws tool. Evidence in scripts/mail_send_with_cc.py and scripts/mail_unread_summary.py shows the use of subprocess.run() with list arguments, which is a standard and safe configuration for executing local binaries within this environment.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from emails. 1. Ingestion points: Data enters via commands in SKILL.md and references/mail.md (e.g., dws mail message get). 2. Boundary markers: SOPs in SKILL.md require human confirmation for writing or destructive actions. 3. Capability inventory: Writing and deleting capabilities exist in SKILL.md (send, reply, trash) and scripts/mail_send_with_cc.py (send). 4. Sanitization: No explicit content sanitization is present in scripts/mail_send_with_cc.py or mail_unread_summary.py, relying instead on manual confirmation procedures.
Audit Metadata