Why this verdict
- suspicious: confirmed overreach finding skill:src/qwenpaw/agents/skills/dingtalk_channel-en:src/qwenpaw/agents/skills/dingtalk_channel-en/SKILL.md:138:PRIVESC
Security findings 1
Privilege escalation
mediumOverreachConfirmed on reviewmedium confidenceThe skill has the agent publish the DingTalk bot and set its visibility to all employees of the enterprise without asking the user to confirm that scope, which is a consequential step beyond the configuration the user approved.
set the application visibility scope to all employees
vector:instruction
Reviewer's reasoning
Step 4 has the agent create and publish a release with visibility set to all employees and select the confirm-publish dialog itself, with no user confirmation of that scope. That is a consequential enterprise-wide publish beyond the channel setup the user asked for, so the skill skips confirmation on a consequential step. The strongest case for a lower level is that publishing is needed for the bot to work and the user invoked the setup, but invoking the skill does not opt the user into every step it takes on its own.
Notes 1
Capabilities, vulnerabilities and disclosed behavior worth knowing. Nothing here works against the person who installs it, so notes never change the verdict.
Credential access
mediumNoteConfirmed on reviewmedium confidenceThe skill has the agent obtain and display the actual Client Secret in the conversation, which exposes a credential in chat history and logs; this is a hygiene issue rather than exfiltration.
obtaining and displaying the `Client ID` and the actual `Client Secret`
vector:instruction
Reviewer's reasoning
The skill tells the agent to obtain and display the Client Secret in the conversation. That is a credential-handling hygiene issue that exposes the secret to the user's own chat, not a transfer to a host that did not issue it, so it is a note. The strongest case for a higher level is that the secret enters model context and logs, but the shown evidence does not establish a transfer to a third party.
Coverage gaps 7
Parts of the artifact the static analysis could not fully examine.
context:unanalyzable_binary binary content is only byte-scanned
plugins/apps/qwenpaw-data/ui/public/data-console/snow-leopard-loading-dark.mp4
context:unanalyzable_binary binary content is only byte-scanned
plugins/apps/qwenpaw-data/ui/public/data-console/snow-leopard-loading.mp4
context:unanalyzable_binary binary content is only byte-scanned
scripts/pack/assets/icon.icns
context:unanalyzable_binary binary content is only byte-scanned
scripts/pack/assets/icon.ico
context:oversize 12157200 bytes > max_file_bytes 8388608
src/qwenpaw/agents/context/visual_compression/assets/atlas-gray-native.ts
context:derived_output_exceeded 1 derived view(s) refused or truncated by the per-file output cap: hidden:json-string-leaf
src/qwenpaw/tokenizer/tokenizer.json
context:bytes_unavailable yara-x: no bytes to scan
src/qwenpaw/agents/context/visual_compression/assets/atlas-gray-native.ts
