The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides installation instructions that use insecure pipe-to-shell patterns to download and execute scripts from a remote repository.
Evidence: curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.sh | sh in SKILL.md.
Evidence: irm https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install.ps1 | iex in SKILL.md.
Evidence: curl -fsSL https://raw.githubusercontent.com/DingTalk-Real-AI/dingtalk-workspace-cli/main/scripts/install-skills.sh | sh in SKILL.md.\n- [PRIVILEGE_ESCALATION]: The instructions include operations that attempt to write to system-level directories, which typically require root or administrator permissions.
Evidence: dws completion bash > /etc/bash_completion.d/dws in SKILL.md.\n- [COMMAND_EXECUTION]: The skill's primary functionality relies on executing a local binary and various shell commands for configuration and management.
Evidence: Multiple examples of dws command usage for authentication, contact management, and task automation.\n- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from DingTalk APIs, which could contain malicious instructions if the external data source is compromised.
Ingestion points: Data returned from dws contact user search, dws calendar event list, and dws todo task list commands.
Boundary markers: The skill does not define specific delimiters or instructions to the agent to ignore potentially malicious content within these data streams.
Capability inventory: The agent has broad capabilities including sending messages (dws ding send), creating tasks, and performing authenticated network operations through the CLI.
Sanitization: There is no evidence of validation or sanitization of the structured JSON output before it is parsed by the AI agent.

dingtalk-workspace-cli