dingtalk-workspace-cli
Fail
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches installation scripts and tool updates from the DingTalk-Real-AI repository on GitHub.
- [REMOTE_CODE_EXECUTION]: Recommends piping remote shell and PowerShell scripts directly into interpreters (sh and iex) for installation tasks.
- [COMMAND_EXECUTION]: Facilitates execution of local CLI commands to manage organizational data, including capabilities for file system writes, data deletion, and message transmission.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources that could contain embedded instructions intended to influence agent behavior.
- Ingestion points: DingTalk contact search, document search results, and AI table record queries (SKILL.md).
- Boundary markers: Instructions do not include markers or warnings to the agent to disregard instructions found within retrieved content.
- Capability inventory: Includes the ability to send messages, modify calendar events, create todos, and download files to the local system.
- Sanitization: No sanitization or filtering logic is described for the data ingested from DingTalk services.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh - DO NOT USE without thorough review
Audit Metadata