dingtalk-minutes

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes Python scripts (minutes_extract_todos.py and minutes_recent_summary.py) to execute the dws binary using subprocess.run. This is the designated method for the skill to communicate with the DingTalk platform to retrieve meeting data and perform updates.
  • [SAFE]: All external communications target the legitimate vendor domain shanji.dingtalk.com. The use of pre-signed URLs for file uploads follows industry-standard secure patterns for data handling within the DingTalk ecosystem.
  • [SAFE]: No patterns of prompt injection, obfuscation, or persistence were detected. The skill includes rigorous documentation and instructions that guide the AI agent to handle errors gracefully and avoid data fabrication, which mitigates indirect prompt injection risks from meeting transcripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 11:21 AM
Security Audit — agent-trust-hub — dingtalk-minutes