Skills dingtalk-bridge

📦

dingtalk-bridge

Name: dingtalk-bridge
Author: mguozhen

Content revision r1 Critical 🌐 Network access📁 Filesystem access⚙️ External commands⚡ Contains scripts🔑 Env variables

Connect AI Coding Agents to DingTalk

Teams need a direct way to share AI coding updates in DingTalk. This skill sends messages, listens for group mentions, and returns AI responses to the same chat.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "dingtalk-bridge" from https://skillstore.io/skills/mguozhen-dingtalk-bridge.md and its manifest at https://skillstore.io/api/skills/mguozhen-dingtalk-bridge/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/mguozhen-dingtalk-bridge.md Signed manifest GET /api/skills/mguozhen-dingtalk-bridge/manifest Signed lockfile GET /api/skills/mguozhen-dingtalk-bridge/lockfile

Test it

Using "dingtalk-bridge". Send a DingTalk message that the deploy is complete.

Expected outcome:

A plain notification is posted to the configured DingTalk group, and the terminal reports that the message was sent.

Using "dingtalk-bridge". Mention the Stream bot in DingTalk and ask for open blockers.

Expected outcome:

The bot acknowledges the request, runs the configured AI CLI in the project directory, and replies with a concise markdown summary.

Using "dingtalk-bridge". Ask for a daily build report with test results and next steps.

Expected outcome:

The group receives a titled markdown report that includes status, blockers, and suggested follow-up actions.

Security Audit

Critical

v4 • 7/21/2026 Open versioned report

The message-sending client and installer patterns are mostly expected or test-only. However, the Stream Bot forwards every nonempty group message to Claude with permission checks disabled and the full environment available. Optional persistent startup increases exposure if this bot is enabled.

Files scanned

1,424

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Critical

src/stream_bot.py:63-75 src/stream_bot.py:102-122

Unauthenticated Group Content Drives a Privileged Local Agent

Every nonempty DingTalk message is forwarded to Claude with permissions skipped. The bot also uses a configured working directory and inherited environment, so untrusted group content can cause local actions and expose ambient secrets.

The handler forwards all nonempty message text to execute_prompt, which invokes Claude with --dangerously-skip-permissions and the full inherited environment.

High

multiple:1

[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism

This combination is common in malware that maintains access

The implementation combines group-message-driven Claude execution with an optional persistent LaunchAgent. The code is not obfuscated, but this combination materially increases the impact of the exposed execution path.

Capability review items (18)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

src/stream_bot.py:63

Python subprocess.run

result = subprocess.run(

The bot passes received chat text to the Claude CLI and explicitly supplies --dangerously-skip-permissions. Group-supplied input can therefore trigger autonomous actions in the configured working directory.

Medium

SKILL.md:17

Ruby/shell backtick execution

| **Stream Bot** | 24/7 listener: receive @mentions, execute via `claude -p`, reply with results |

The documentation describes a real feature that executes DingTalk mention content through the Claude CLI. This is a security-sensitive remote-input execution path.

Medium

SKILL.md:85-90

Ruby/shell backtick execution

3. Execute the message content via `claude -p "<message>" --continue`

The documentation describes a real feature that executes DingTalk mention content through the Claude CLI. This is a security-sensitive remote-input execution path.

Medium

src/stream_bot.py:4

Ruby/shell backtick execution

Receives @mentions in group, executes via `claude -p`, replies with result.

The module documentation accurately describes the implemented behavior: received mentions are executed through claude -p. This exposes the local agent to untrusted chat content.

Low

src/config.py:35

Python environment access

val = os.environ.get(env_key)

The configuration loader reads environment variables that can contain DingTalk credentials. Secret handling is a real security-sensitive operation.

Low

src/send.py:16

Python HTTP libraries

import urllib.request

This is the intended DingTalk API client path and sends configured credentials or message content over the network. It is a real external-data boundary, although it is integral to the declared function.

Low

src/send.py:32

Python HTTP libraries

req = urllib.request.Request(

Low

src/send.py:37

Python HTTP libraries

resp = json.loads(urllib.request.urlopen(req, timeout=10).read())

Low

src/send.py:69

Python HTTP libraries

req = urllib.request.Request(

Low

src/send.py:77

Python HTTP libraries

return json.loads(urllib.request.urlopen(req, timeout=10).read())

Low

src/send.py:89

Python HTTP libraries

req = urllib.request.Request(

Low

src/send.py:97

Python HTTP libraries

return json.loads(urllib.request.urlopen(req, timeout=10).read())

Low

src/send.py:105

Python HTTP libraries

req = urllib.request.Request(

Low

src/send.py:110

Python HTTP libraries

urllib.request.urlopen(req, timeout=10)

Low

src/send.py:33

Hardcoded URL

"https://api.dingtalk.com/v1.0/oauth2/accessToken",

Low

src/send.py:70

Hardcoded URL

"https://api.dingtalk.com/v1.0/robot/groupMessages/send",

Low

src/send.py:90

Hardcoded URL

"https://api.dingtalk.com/v1.0/robot/groupMessages/send",

Low

src/stream_bot.py:74

Python environment access

env=os.environ,

The process passes the complete inherited environment to the Claude subprocess. This can expose unrelated ambient secrets to commands induced by group messages.

Risk Factors

🌐 Network access (26)

📁 Filesystem access (17)

README.md:60 README.md:63 README.md:84 README.md:98 README.md:60 README.md:63 README.md:84 README.md:98 scripts/install.sh:11 scripts/install.sh:102 tests/test_dingtalk.py:67 tests/test_dingtalk.py:68 tests/test_dingtalk.py:11 tests/test_dingtalk.py:107 tests/test_dingtalk.py:180 tests/test_dingtalk.py:317 tests/test_dingtalk.py:339

⚙️ External commands (40)

⚡ Contains scripts (2)

src/config.py:44 tests/test_dingtalk.py:253

🔑 Env variables (24)

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/mguozhen-dingtalk-bridge/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/mguozhen-dingtalk-bridge/security.svg)](https://skillstore.io/skills/mguozhen-dingtalk-bridge?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/mguozhen-dingtalk-bridge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mguozhen-dingtalk-bridge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/mguozhen-dingtalk-bridge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

mguozhen. (2026). dingtalk-bridge security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mguozhen-dingtalk-bridge/audits/4

BibTeX citation

@techreport{mguozhen-mguozhen-dingtalk-bridge-2026,
  author = {mguozhen},
  title = {dingtalk-bridge security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/mguozhen-dingtalk-bridge/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "dingtalk-bridge security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "mguozhen"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/mguozhen-dingtalk-bridge/audits/4"
identifiers:
  - type: other
    value: "skillstore:mguozhen-dingtalk-bridge:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Send Release Updates

Post build, test, and deployment status to a DingTalk group from an AI coding session.

Answer Team Requests

Let trusted teammates mention the bot and receive AI-generated project responses in the group chat.

Prototype Internal Chat Automation

Use DingTalk Stream and OpenAPI examples to build a small internal assistant workflow.

Try These Prompts

Send A Simple Update

Send a DingTalk message to the configured group: The staging deploy is complete.

Send A Markdown Report

Send a DingTalk markdown message titled Daily Build Report with today's test status and blockers.

Start The Stream Bot

Check my DingTalk Bridge configuration, then start the Stream bot for this project and explain any missing credentials.

Review Bot Safety

Review this project before enabling DingTalk Bridge auto execution. Identify who can trigger it, what workdir it uses, and what safeguards are missing.

Best Practices

Keep DingTalk credentials in environment variables or a permission-restricted config file.
Run the Stream bot only in trusted groups with clear ownership and monitoring.
Use a least-privileged work directory and review prompts before enabling automatic execution.

Avoid

Do not expose the Stream bot to broad groups or untrusted chat participants.
Do not run the LaunchAgent on sensitive workstations without monitoring and an unload plan.
Do not commit DingTalk app secrets or conversation metadata to shared repositories.