dingtalk-adoc-reader
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFEDATA_EXFILTRATIONPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The DingTalkClient in client.py initializes its HTTP transport with verify=False, disabling SSL/TLS certificate verification. This makes the session vulnerable to Man-in-the-Middle (MITM) attacks, potentially allowing an attacker on the same network to intercept and steal sensitive DingTalk session cookies (such as atoken and ssotoken).
- [PROMPT_INJECTION]: The skill ingests untrusted data from DingTalk documents, posing a risk of indirect prompt injection. 1. Ingestion points: Document content is fetched via get_document_data in client.py and processed by extract_text_from_alidocs in transformer.py. 2. Boundary markers: No delimiters or warnings are used to separate external content from agent instructions. 3. Capability inventory: The skill performs network operations via httpx and writes files to the local system. 4. Sanitization: The transformer.py script performs noise filtering but lacks security-focused sanitization against malicious instructions embedded in documents.
- [EXTERNAL_DOWNLOADS]: The skill interacts with alidocs.dingtalk.com and associated Alibaba Cloud (OSS) infrastructure to download files and export documents to PDF. It also utilizes Playwright, which downloads browser binaries. These operations target well-known service endpoints consistent with the skill's purpose.
- [COMMAND_EXECUTION]: The skill uses the Playwright library in auth.py to programmatically launch and control a Chromium browser instance for automating the QR code login flow.
Audit Metadata