Bot identity may broaden access to other people's OKRs
Source references: 6The Skill permits `--as bot` for viewing others' OKRs, but the visible instructions do not require prior user consent, a demonstrated business need, or first checking the narrower user-identity access. Cycle details may include objectives, notes, scores, weights, deadlines, and owner information.
If the bot has broader tenant permissions than the current user, the agent could obtain employee goals, scoring-related data, or internal notes the user could not normally see and expose them in the current conversation.
The material allows bot-identity access to another person's OKRs, but explicitly requires corresponding permission, and viewing others' OKRs is within the stated purpose. The decisive authentication, authorization, and safety rules are delegated to an unavailable `lark-shared/SKILL.md`, so the evidence cannot establish whether consent or least-privilege checks are missing, or whether bot identity actually exposes more data. Users should request those shared rules and restrict the bot token to necessary read-only OKR access.
This assessment concerns the code and conditions shown, not proof that harm has occurred.**身份**：OKR 操作默认使用 `--as user`（查看当前用户/上下级的 OKR 时）。也支持 `--as bot` 查看他人 OKR（需相应权限）。Show 5 other places
"update_time": "2025-01-15 12:00:00", "owner": { "owner_type": "user", "user_id": "ou_xxx" }, "cycle_id": "1234567890123456789", "position": 0, "score": 0.75, "weight": 1.0, "deadline": "2025-06-30 23:59:59", "category_id": "cat_456", "content": "{...}", "notes": "{...}", "key_results": [|--------------------------------|------|--------------|| `okr:okr.content:readonly` | 读 | 读取 OKR 内容 || `okr:okr.content:writeonly` | 写 | 写入/删除 OKR 内容 || `okr:okr.period:readonly` | 读 | 读取 OKR 周期 || `okr:okr.progress:readonly` | 读 | 读取进展记录 |version: 1.0.0description: "飞书 OKR：管理目标与关键结果。查看和编辑 OKR 周期、目标、关键结果、对齐关系、量化指标和进展记录。当用户需要查看或创建 OKR、管理目标和关键结果、查看对齐关系时使用。不负责：待办任务管理（lark-task）、日程/会议安排（lark-calendar）、绩效评估"metadata:**CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理****身份**：OKR 操作默认使用 `--as user`（查看当前用户/上下级的 OKR 时）。也支持 `--as bot` 查看他人 OKR（需相应权限）。1. 使用 `lark-cli okr +cycle-list` 获取 OKR 周期 ID。2. 执行 `lark-cli okr +cycle-detail --cycle-id "123456"`。3. 报告结果：找到的目标数量、每个目标的 ID、分数、权重及其关键结果。