Skip to content
skillsafebeta
← Report library
Purpose / Other

Lark Approval Skill Security Audit

What the author says it does (original text)

飞书审批：查询和处理审批待办/已办/实例，搜索可发起审批定义、查看定义详情并发起原生审批实例。当用户要处理审批任务、查看审批实例、搜索或发起审批时使用。审批待办不是飞书任务；非审批类待办走 lark-task。不负责创建审批定义；三方审批定义不走原生提单。

Independent security check

Security risks found

Files checked
17
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Instance-detail queries bring sensitive approval data into the agent session

Source references: 6
What we found

Instance details include initiator and department identifiers, full forms, current nodes, approver tasks, comments, and operation history; task lists also include names and form summaries. These commonly contain expense, leave, HR, or procurement information.

Why this matters

Broad queries or displaying, logging, or forwarding raw results could expose personal information, financial material, leave reasons, and internal decision records to people or systems that do not need them.

Legitimate use of this code

Instance details do include identifiers, form data, nodes, tasks, comments, and history, but this is a user-scoped read operation matching the stated purpose of viewing an approval. The main workflow says to fetch details only when the user explicitly asks for the form, node, or progress, avoiding default collection. No instruction shown sends this data to another third party or broadens access. For sensitive HR or financial approvals, users can request only the task list or ask that unnecessary fields be omitted.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/lark-approval-instances-get.md:6In the instructionsOpen original file
需要的 scopes: ["approval:instance:read"]
Show 5 other places
references/lark-approval-instances-get.md:61In the instructionsOpen original file
| `definition_name` | 审批名称 || `user_id` | 发起审批的用户 ID || `department_id` | 发起人所在部门 ID || `status` | 审批实例状态，见下方“status 枚举” || `reverted` | 单据是否已被撤销 || `start_time` | 审批创建时间 || `end_time` | 审批完成时间，未完成时通常为 `0` || `form` | 表单数据，JSON 字符串 || `current_nodes` | 当前审批节点列表 || `tasks` | 审批任务列表 || `operation_records` | 审批动态，例如通过、拒绝、转交、加签、回退、撤回、抄送 || `comments` | 评论列表 |
references/lark-approval-tasks-query.md:6In the instructionsOpen original file
需要的 scopes: ["approval:task:read"]
references/lark-approval-tasks-query.md:73In the instructionsOpen original file
| `tasks[].definition_code` | 审批定义 Code || `tasks[].definition_name` | 审批定义名称 || `tasks[].initiator` | 发起人 ID || `tasks[].initiator_name` | 发起人姓名 || `tasks[].summaries` | 表单摘要字段列表 || `tasks[].support_api_operate` | 是否支持通过 API 同意或拒绝该任务 |
references/lark-approval-instances-get.md:4In the instructionsOpen original file
获取单个审批实例详情（用户级只读操作）。适合在执行 approve / reject / transfer / rollback / cancel / cc / remind 之前，先查看审批表单、当前节点、任务列表、审批动态和整体状态。需要的 scopes: ["approval:instance:read"]
SKILL.md:58In the instructionsOpen original file
- 目标只是处理待办时，优先 `tasks query` 获取 `instance_code` + `task_id`- **只有**用户明确要看详情、当前节点、表单内容、流程进度时，才调用 `instances get`- 用户已经明确给出 `instance_code` / `task_id` 时，不要先查列表再过滤
Medium risk

Third-party approval links move the user outside the native approval flow

Source references: 4
What we found

For definitions where `is_external=true`, the Skill returns and recommends the API-provided `create_link` instead of using the native creation endpoint. The visible instructions do not require verification of the link's domain, system owner, or data processor.

Why this matters

If the link is wrong, replaced, or misconfigured, expense, HR, or identity information entered there could go to an unintended third party. The external page may also have different access and retention rules.

What this evidence establishes

The source confirms that external definitions are not created through the native API; instead, the API-provided `create_link` is returned to the user. No domain or ownership validation rule is visible, but there is also no instruction to open the link automatically, submit credentials, or send approval data to it. Risk depends on the returned link's trustworthiness and whether the user follows it, so the evidence is insufficient for a stronger finding. Users can verify the domain, tenant, and destination and ask whether links are allowlisted or labeled by source.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/lark-approval-approvals-search.md:53In the instructionsOpen original file
|------|------|| `approval_code` | 审批定义 Code；后续 `approvals get` 和 `instances create` 都要用它 || `approval_name` | 审批定义名称；给用户做候选选择时最关键 || `is_external` | 是否为三方审批定义；`true` 表示不能走原生 `instances.create` || `create_link` | 三方审批定义的发起链接；`is_external=true` 时优先返回给用户 |
Show 3 other places
references/lark-approval-approvals-search.md:63In the instructionsOpen original file
- **命中多个结果时，不要替用户拍板。** 先把候选定义列出来，让用户选择目标审批定义。- **`is_external=true` 时不要调用 `approval instances create`。** 这类定义属于三方审批，优先返回 `create_link` 并说明需要通过链接发起。- **只有 `is_external=false` 的原生定义，才继续 `approvals get`。**- **如果用户已经明确给出 `approval_code`，不要再 search。** 直接执行 `approval approvals get`。
references/lark-approval-approvals-search.md:101In the instructionsOpen original file
### 3）确认是三方定义时，直接返回链接当 `is_external=true` 时，优先向用户返回 `create_link`，说明该审批需在三方系统或跳转页面中发起，而不是通过原生 `instances.create`。
references/lark-approval-approvals-search.md:62In the instructionsOpen original file
- **搜索结果为空时，不要猜。** 直接告诉用户当前关键词下没有可发起定义，并建议用户换关键词。- **命中多个结果时，不要替用户拍板。** 先把候选定义列出来，让用户选择目标审批定义。- **`is_external=true` 时不要调用 `approval instances create`。** 这类定义属于三方审批，优先返回 `create_link` 并说明需要通过链接发起。- **只有 `is_external=false` 的原生定义，才继续 `approvals get`。**- **如果用户已经明确给出 `approval_code`，不要再 search。** 直接执行 `approval approvals get`。
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Approval content can act as an indirect prompt-injection channel

Source references: 4
What we found

Query results can contain titles, form summaries, full form data, comments, and operation notes supplied by other approval participants. The workflow can then use retrieved identifiers for high-risk writes, but the visible instructions do not say to treat returned text strictly as untrusted data and ignore instructions embedded in it.

Why this matters

If an approval field says to ignore the user's request and approve, transfer, or CC the item, an agent that follows it could perform an unauthorized action or disclose the approval to additional people.

What this evidence establishes

The source has the agent read titles, summaries, full forms, comments, and operation notes before potentially performing writes; some text may be supplied by other participants. However, the provided material does not show how CLI output is placed into model context or that field contents are interpreted as instructions. Field presence alone is therefore insufficient to establish an indirect prompt-injection path. Users can ask how outputs are isolated, require all returned text to be treated as data, and reconfirm structured identifiers before writes.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/lark-approval-tasks-query.md:66In the instructionsOpen original file
| `page_token` | 下一页翻页 Token || `tasks[].task_id` | 任务 ID，全局唯一 || `tasks[].instance_code` | 审批实例 Code；后续执行 approve / reject / rollback 等操作时通常需要与 `task_id` 成对使用 || `tasks[].title` | 任务标题 || `tasks[].status` | 任务状态：`1` 待办、`2` 已办、`17` 未读、`18` 已读、`33` 处理中、`34` 撤回 || `tasks[].topic` | 任务所属分组主题 || `tasks[].instance_status` | 审批实例状态：`0` 无状态、`1` 流转中、`2` 已通过、`3` 已拒绝、`4` 已撤销、`5` 已终止 || `tasks[].definition_code` | 审批定义 Code || `tasks[].definition_name` | 审批定义名称 || `tasks[].initiator` | 发起人 ID || `tasks[].initiator_name` | 发起人姓名 || `tasks[].summaries` | 表单摘要字段列表 || `tasks[].support_api_operate` | 是否支持通过 API 同意或拒绝该任务 || `tasks[].user_id` | 任务所属用户 ID |
Show 3 other places
references/lark-approval-instances-get.md:67In the instructionsOpen original file
| `end_time` | 审批完成时间，未完成时通常为 `0` || `form` | 表单数据，JSON 字符串 || `current_nodes` | 当前审批节点列表 || `tasks` | 审批任务列表 || `operation_records` | 审批动态，例如通过、拒绝、转交、加签、回退、撤回、抄送 || `comments` | 评论列表 |
SKILL.md:64In the instructionsOpen original file
- 已拿到 `instance_code` + `task_id` 后，优先直接执行 `tasks approve/reject/transfer/add_sign/rollback/remind`- 同一轮里如果已有足够的新鲜查询结果，不要重复 `tasks query`
references/lark-approval-tasks-query.md:83In the instructionsOpen original file
## 使用建议- 常见处理链：先用 `tasks query` 拿到 `task_id` 和 `instance_code`，若用户需要查看详情、当前节点、表单内容、流程进度等内容，则调用 `instances get` 查看详情，最后执行 `tasks approve` / `tasks reject` / `tasks transfer` / `tasks add_sign` / `tasks rollback`。- 如果你只想看“已发起的审批实例”，使用 `instances initiated`；`tasks query` 更适合围绕“任务分组”来拉取列表。- 需要搜索任务标题、摘要或相关内容时传入 `keyword`；搜索排序和普通列表排序不同，按搜索服务结果为准。
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The Skill can make approval decisions with real business consequences as the user

Source references: 6
What we found

Once granted write access, it can approve, reject, transfer, roll back, or cancel real approvals and recommends direct execution when instance and task identifiers are available. The documented confirmation helps, but protection ultimately depends on the agent selecting the correct target and interpreting the user's authorization correctly.

Why this matters

A wrong document, task, or recipient could approve an unauthorized expense or personnel request, reject a valid request, change responsibility, or cancel an active submission.

The source supports this risk. The Skill permits approving, rejecting, transferring, rolling back, and canceling approvals as the current user, and prefers direct execution once identifiers are known. These actions can change real workflow state or responsibility. Explicit consent, target checking, and dry-run guidance reduce—but do not eliminate—the impact of misunderstood authorization or a mistaken target. Users can restrict write scopes and require a final summary of the approval, task, action, and recipient.

SKILL.md:62In the instructionsOpen original file
### 2) 已知对象时直达动作- 已拿到 `instance_code` + `task_id` 后，优先直接执行 `tasks approve/reject/transfer/add_sign/rollback/remind`- 同一轮里如果已有足够的新鲜查询结果，不要重复 `tasks query`- 不要默认走 `list -> filter -> detail -> write` 全链路；对象已明确时应压缩步骤
Show 5 other places
references/lark-approval-tasks-approve.md:6In the instructionsOpen original file
> [!CAUTION]> 这是 **high-risk-write** 写操作。建议先用 `--dry-run` 预览；真正执行时，如果用户已明确同意审批且目标任务无误，再带 `--yes` 运行。不要在未获用户明确同意时静默追加 `--yes`。需要的 scopes: ["approval:task:write"]
references/lark-approval-instances-cancel.md:4In the instructionsOpen original file
撤回一个已发起的审批实例（用户级写操作）。通常先通过 `instances initiated`、`tasks query` 或 `instances get` 确认目标审批实例，拿到 `instance_code` 后再执行撤回。> [!CAUTION]> 这是 **high-risk-write** 写操作。建议先用 `--dry-run` 预览；真正执行时，如果用户已明确要撤回该审批实例且目标实例无误，再带 `--yes` 运行。不要在未获用户明确同意时静默追加 `--yes`。需要的 scopes: ["approval:instance:write"]
SKILL.md:39In the instructionsOpen original file
| 看表单/进度/当前节点 | `instances get` | [`lark-approval-instances-get.md`](references/lark-approval-instances-get.md)   || 同意审批 | `tasks approve` | [`lark-approval-tasks-approve.md`](references/lark-approval-tasks-approve.md)   || 拒绝审批 | `tasks reject` | [`lark-approval-tasks-reject.md`](references/lark-approval-tasks-reject.md)     || 转交审批 | `tasks transfer` | [`lark-approval-tasks-transfer.md`](references/lark-approval-tasks-transfer.md) || 加签审批 | `tasks add_sign` | [`lark-approval-tasks-add-sign.md`](references/lark-approval-tasks-add-sign.md) || 退回审批 | `tasks rollback` | [`lark-approval-tasks-rollback.md`](references/lark-approval-tasks-rollback.md) || 催办审批 | `tasks remind` | [`lark-approval-tasks-remind.md`](references/lark-approval-tasks-remind.md)     || 撤回已发起审批 | `instances cancel` | [`lark-approval-instances-cancel.md`](references/lark-approval-instances-cancel.md) || 给审批实例追加抄送 | `instances cc` | [`lark-approval-instances-cc.md`](references/lark-approval-instances-cc.md)     |
SKILL.md:64In the instructionsOpen original file
- 已拿到 `instance_code` + `task_id` 后，优先直接执行 `tasks approve/reject/transfer/add_sign/rollback/remind`- 同一轮里如果已有足够的新鲜查询结果，不要重复 `tasks query`- 不要默认走 `list -> filter -> detail -> write` 全链路；对象已明确时应压缩步骤
references/lark-approval-instances-cancel.md:6In the instructionsOpen original file
> [!CAUTION]> 这是 **high-risk-write** 写操作。建议先用 `--dry-run` 预览；真正执行时，如果用户已明确要撤回该审批实例且目标实例无误，再带 `--yes` 运行。不要在未获用户明确同意时静默追加 `--yes`。需要的 scopes: ["approval:instance:write"]

Inside this skill

5 instruction sections

This Skill uses `lark-cli` as the current user to query approval definitions, tasks, and instances, and can initiate, approve, reject, transfer, add signers, roll back, remind, cancel, or CC approvals.

View source
SKILL.md:37In the instructionsOpen original file
| 发起原生审批实例/提交请假审批/提交报销审批/创建审批实例 | `instances create` | [`lark-approval-initiate.md`](references/lark-approval-initiate.md)             || 查/搜待办、已办 | `tasks query`（`topic`：1待办 2已办 17未读 18已读） | [`lark-approval-tasks-query.md`](references/lark-approval-tasks-query.md)       || 看表单/进度/当前节点 | `instances get` | [`lark-approval-instances-get.md`](references/lark-approval-instances-get.md)   || 同意审批 | `tasks approve` | [`lark-approval-tasks-approve.md`](references/lark-approval-tasks-approve.md)   || 拒绝审批 | `tasks reject` | [`lark-approval-tasks-reject.md`](references/lark-approval-tasks-reject.md)     || 转交审批 | `tasks transfer` | [`lark-approval-tasks-transfer.md`](references/lark-approval-tasks-transfer.md) || 加签审批 | `tasks add_sign` | [`lark-approval-tasks-add-sign.md`](references/lark-approval-tasks-add-sign.md) || 退回审批 | `tasks rollback` | [`lark-approval-tasks-rollback.md`](references/lark-approval-tasks-rollback.md) || 催办审批 | `tasks remind` | [`lark-approval-tasks-remind.md`](references/lark-approval-tasks-remind.md)     || 撤回已发起审批 | `instances cancel` | [`lark-approval-instances-cancel.md`](references/lark-approval-instances-cancel.md) || 给审批实例追加抄送 | `instances cc` | [`lark-approval-instances-cc.md`](references/lark-approval-instances-cc.md)     || 按定义/关键词查已发起审批 | `instances initiated` | [`lark-approval-instances-initiated.md`](references/lark-approval-instances-initiated.md) |

Approval writes use user-level authority. Task processing requires `approval:task:write`, while initiating an instance requires `approval:instance:write`, so actions affect the real workflow as the user.

View source
references/lark-approval-tasks-approve.md:9In the instructionsOpen original file
需要的 scopes: ["approval:task:write"]
references/lark-approval-initiate.md:156In the instructionsOpen original file
### 6. 创建审批实例创建命令使用 `approval instances create`，需要的 scopes: ["approval:instance:write"]

The documentation adds confirmation and preview controls for high-risk writes: `--yes` should be used only after explicit user approval and target verification, with `--dry-run` recommended first. Initiation additionally requires confirmation of the definition, form values, and node participants.

View source
references/lark-approval-tasks-approve.md:6In the instructionsOpen original file
> [!CAUTION]> 这是 **high-risk-write** 写操作。建议先用 `--dry-run` 预览；真正执行时，如果用户已明确同意审批且目标任务无误，再带 `--yes` 运行。不要在未获用户明确同意时静默追加 `--yes`。
references/lark-approval-initiate.md:13In the instructionsOpen original file
- **看到 `need_approver=true` 就说明该节点需要发起人补充审批人。** 如果 `approver_chosen_multi=false`，该节点只允许一个 `open_id`。- **创建实例前先确认。** `approval instances create` 是写操作，执行前，让用户确认最终定义、表单值和节点参数；真正执行时显式传 `--yes`。

The Skill depends on out-of-package shared authentication instructions and contact-resolution capabilities. Those referenced files are not included in the supplied source, so their authentication, permission-request, and identity-resolution behavior cannot be verified here.

View source
SKILL.md:12In the instructionsOpen original file
**CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理**
references/lark-approval-initiate.md:8In the instructionsOpen original file
- **`is_external=true` 的定义是三方定义。** 这类定义不要调用 `instances create`，应优先使用 `create_link`。- **所有人员类参数默认使用 `open_id`。** 若用户给的是姓名、邮箱或其他身份，先用 [`../../lark-contact/SKILL.md`](../../lark-contact/SKILL.md) 解析。- **先读控件参数 reference 和值来源 reference，再读本文里的创建参数规则。** 提单前必须先阅读 [`lark-approval-instance-form-control-parameters.md`](./lark-approval-instance-form-control-parameters.md) 和 [`lark-approval-instance-value-sourcing.md`](./lark-approval-instance-value-sourcing.md)。
Start here · InstructionsSKILL.md
lark-approval
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 19
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records17 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/lark-approval-approvals-get.mdFull text included
  • references/lark-approval-approvals-search.mdFull text included
  • references/lark-approval-initiate.mdFull text included
  • references/lark-approval-instances-cancel.mdFull text included
  • references/lark-approval-instances-cc.mdFull text included
  • references/lark-approval-instances-get.mdFull text included
  • references/lark-approval-instances-initiated.mdFull text included
  • references/lark-approval-tasks-add-sign.mdFull text included
  • references/lark-approval-tasks-approve.mdFull text included
  • references/lark-approval-tasks-query.mdFull text included
  • references/lark-approval-tasks-reject.mdFull text included
  • references/lark-approval-tasks-remind.mdFull text included
  • references/lark-approval-tasks-rollback.mdFull text included
  • references/lark-approval-tasks-transfer.mdFull text included
  • references/lark-approval-instance-form-control-parameters.mdFull text included
  • references/lark-approval-instance-value-sourcing.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-approval-approvals-get.mdSupporting file
  • references/lark-approval-approvals-search.mdSupporting file
  • references/lark-approval-initiate.mdSupporting file
  • references/lark-approval-instance-form-control-parameters.mdSupporting file
  • references/lark-approval-instance-value-sourcing.mdSupporting file
  • references/lark-approval-instances-cancel.mdSupporting file
  • references/lark-approval-instances-cc.mdSupporting file
  • references/lark-approval-instances-get.mdSupporting file
  • references/lark-approval-instances-initiated.mdSupporting file
  • references/lark-approval-tasks-add-sign.mdSupporting file
  • references/lark-approval-tasks-approve.mdSupporting file
  • references/lark-approval-tasks-query.mdSupporting file
  • references/lark-approval-tasks-reject.mdSupporting file
  • references/lark-approval-tasks-remind.mdSupporting file
  • references/lark-approval-tasks-rollback.mdSupporting file
  • references/lark-approval-tasks-transfer.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:89In the instructionsOpen original file
```bashlark-cli approval approvals search --data '{"keyword":"请假"}' --as user
references/lark-approval-approvals-get.md:10In the instructionsOpen original file
```bash# 按 approval_code 查询审批定义详情
references/lark-approval-approvals-get.md:36In the instructionsOpen original file
```bashlark-cli approval approvals get --params '{"approval_code":"<APPROVAL_CODE>"}' --as user
Connect to websites
references/lark-approval-initiate.md:220In the instructionsOpen original file
- instance_code: 19EAC829-F1CB-527F-BE2A-1330422E60C0- instance_link: https://...```
Lines read
2,417
File checksum (to compare versions)
b820960e4f69a0d0609b0ac9e18ebc2fa9f5f8d06ca032e8350ab034c331b12c