dingtalk-docs-reader
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE]: The skill requires the user to provide a full browser cookie string for authentication. This cookie contains sensitive session identifiers such as XSRF-TOKEN and doc_atoken, which are transmitted to the official alidocs.dingtalk.com domain to access internal web APIs.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external DingTalk documents and file attachments. This content is extracted and potentially passed to the AI agent, creating a surface for indirect prompt injection. \n
- Ingestion points: Document data retrieval in scripts/client.py and recursive text extraction in scripts/transformer.py. \n
- Boundary markers: The skill does not implement specific delimiters or 'ignore' instructions for the extracted content. \n
- Capability inventory: The skill can perform network requests via httpx, download files, and initiate a multi-step PDF export process. \n
- Sanitization: While the transformer filters technical metadata and noise, it does not sanitize the content for adversarial prompt instructions.
Audit Metadata