dws-shared
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions frequently involve executing shell commands via the 'dws' CLI. Specific guidance in 'references/best_practices/_common/conventions.md' suggests using shell operators like '&' for parallel execution, which requires the agent to carefully handle user-supplied arguments to prevent command injection.- [CREDENTIALS_UNSAFE]: 'references/channel-login.md' contains multiple hardcoded 'channelCode' values (e.g., '18451e165920b301ade00efae99b2c253e1e900b') and a 'profile' ID ('dingd8e1123006514592:04061459256343'). These are documented as public identifiers used to identify distribution channels and organizational profiles during the authentication process.- [DATA_EXFILTRATION]: The skill provides the agent with capabilities to read sensitive information from various DingTalk products, including private messages, documents, and meeting minutes. It also includes instructions for downloading files to local storage using 'dws drive download'.- [PROMPT_INJECTION]: The skill processes untrusted external data, such as user-provided URLs and document content, to determine its actions.
- Ingestion points: 'references/url-patterns.md' defines how the agent should parse and react to various DingTalk URLs, while 'references/intent-guide.md' maps user queries to specific product logic.
- Boundary markers: No specific boundary markers or delimiters are defined to isolate untrusted input within prompts.
- Capability inventory: The agent can perform a wide range of actions through the 'dws' CLI, including sending messages, creating tasks, and modifying documents.
- Sanitization: The instructions mitigate risk by requiring the use of '--format json' for structured output and prohibiting the guessing of command parameters.
Audit Metadata