dingtalk-adoc-reader

SUSPICIOUS: the skill is internally coherent as a DingTalk document reader and routes data to official DingTalk infrastructure, so it does not show strong malware or credential-harvesting signals. However, it relies on sensitive browser-session cookies and reverse-engineered internal APIs instead of official scoped integrations, which creates meaningful security and trust risk.

This module automates a headless browser to capture QR images and extract/return all browser cookies after a successful login to alidocs.dingtalk.com. While it does not itself exfiltrate data over the network or perform obvious malicious actions, it explicitly harvests authentication cookies and stores them in a session object. That capability is sensitive and could be abused (or lead to credential theft) depending on how callers use or transmit the session.cookie value. If you intend to use this code, treat the returned cookie string as highly sensitive, restrict access to LoginSession objects, and avoid sending them over untrusted channels. There is no clear evidence of obfuscation or standalone malware in this fragment, but the cookie-harvesting behavior raises a moderate security risk in supply-chain or misuse scenarios.