The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the 'dws' CLI binary to perform actions across the DingTalk ecosystem. Multiple Python scripts located in the scripts/ directory (e.g., yida_custom_page_update.py, attendance_report_checkin.py, aiapp_create_and_poll.py) use the subprocess.run function to invoke this binary with arguments often derived from agent context. These calls are implemented safely without the use of shell execution (shell=False), reducing the risk of shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection because it is designed to ingest and process untrusted data from external sources, including DingTalk reports, OA approval instances, and spreadsheet cells.
Ingestion points: Untrusted data enters the agent context through commands like report inbox list (referenced in references/report.md), doc fetch (referenced in references/whiteboard.md), and sheet range read (referenced in references/sheet/sheet-read-data.md).
Boundary markers: Explicit delimiters or 'ignore embedded instructions' warnings are generally absent in the instruction templates when processing this data.
Capability inventory: The skill has significant capabilities, including the ability to write to spreadsheets, create OA instances, and manage developer applications via the dws binary invoked through subprocess.run (e.g., in scripts/oa_batch_approve.py and scripts/yida_form_update.py).
Sanitization: While no explicit content sanitization logic is present in the markdown instructions, the Python scripts utilize standard JSON libraries (json.loads/json.dumps) to handle data structures, providing some inherent protection against structural injection.
[EXTERNAL_DOWNLOADS]: Several utility scripts (e.g., scripts/attendance_report_checkin.py, scripts/attendance_report_common.py) contain instructions or checks for third-party Python packages including openpyxl, requests, and Pillow. These are standard, well-known libraries used for Excel generation, HTTP requests, and image processing respectively.
[DYNAMIC_EXECUTION]: The Yida-related scripts (e.g., yida_page_compiler.py and yida_jsx_pipeline.py) perform runtime compilation and transformation of JSX code into DingTalk-compatible schemas. This behavior is the primary intended function of the Yida developer tools and is restricted to the specific task of low-code page generation.
[CREDENTIALS_SAFE]: The skill includes specific instructions to protect sensitive information. For example, references/dev/credentials.md explicitly forbids restating appSecret or clientSecret values in answers or logs, and mandates that they be handled only through the underlying binary without exposure.

dingtalk-misc