dingtalk-minutes
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python scripts (
minutes_extract_todos.pyandminutes_recent_summary.py) to execute thedwsbinary usingsubprocess.run. This is the designated method for the skill to communicate with the DingTalk platform to retrieve meeting data and perform updates. - [SAFE]: All external communications target the legitimate vendor domain
shanji.dingtalk.com. The use of pre-signed URLs for file uploads follows industry-standard secure patterns for data handling within the DingTalk ecosystem. - [SAFE]: No patterns of prompt injection, obfuscation, or persistence were detected. The skill includes rigorous documentation and instructions that guide the AI agent to handle errors gracefully and avoid data fabrication, which mitigates indirect prompt injection risks from meeting transcripts.
Audit Metadata