Skip to content
skillsafebeta
← Report library
Purpose / Documents

Lark OpenAPI Explorer Skill Security Audit

What the author says it does (original text)

飞书/Lark 原生 OpenAPI 探索：从官方文档库中挖掘未经 CLI 封装的原生 OpenAPI 接口。当用户的需求无法被现有 lark-* skill 或 lark-cli 已注册命令满足，需要查找并调用原生飞书 OpenAPI 时使用。

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

General GET calls may retrieve sensitive Lark data accessible to the active credentials

Source references: 5
What we found

The Skill permits native GET requests to discovered endpoints and instructs the agent to present its results. The confirmation rule visible in this file covers only POST, PUT, and DELETE; there is no visible per-request confirmation, field filtering, or redaction requirement for GET calls that read contacts, messages, or other sensitive content. The external `lark-shared` file may add rules, but they cannot be verified from this evidence.

Why this matters

If the chosen endpoint contains personal information, messages, or internal business data, its response may enter the agent context and be shown to the current chat user, widening exposure of that data.

What this evidence establishes

The source provides a generic GET mechanism, and the visible per-operation confirmation rule names only POST, PUT, and DELETE. However, it supplies no concrete GET endpoint for contacts, messages, or other sensitive data, and it does not say GET requests run automatically or that raw responses are shown to the user. It also requires security rules from `lark-shared`, which are absent from the evidence. A general read capability bounded by the active credentials is supported, but these lines alone do not establish that sensitive data would be read or disclosed without authorization or redaction. Before use, users can request the exact endpoint, returned fields, required scopes, and output handling.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:83In the instructionsOpen original file
```bash# GET 请求lark-cli api GET /open-apis/<path> --params '{"key":"value"}'# POST 请求lark-cli api POST /open-apis/<path> --data '{"key":"value"}'
Show 4 other places
SKILL.md:97In the instructionsOpen original file
## 输出规范向用户呈现挖掘结果时，按以下格式组织：1. **API 名称与功能**：一句话描述2. **HTTP 方法与路径**：`METHOD /open-apis/...`3. **关键参数**：列出必填和常用可选参数4. **所需权限**：scope 列表5. **调用示例**：给出 `lark-cli api` 的完整命令6. **注意事项**：频率限制、特殊约束等
SKILL.md:112In the instructionsOpen original file
- **写入/删除类 API**（POST/PUT/DELETE）调用前必须确认用户意图- 建议先用 `--dry-run` 预览请求（如支持）- 不要猜测 API 路径或参数——必须从文档中获取确认
SKILL.md:12In the instructionsOpen original file
> **前置条件：** 先阅读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md) 了解认证、身份切换和安全规则。
SKILL.md:101In the instructionsOpen original file
1. **API 名称与功能**：一句话描述2. **HTTP 方法与路径**：`METHOD /open-apis/...`3. **关键参数**：列出必填和常用可选参数4. **所需权限**：scope 列表5. **调用示例**：给出 `lark-cli api` 的完整命令6. **注意事项**：频率限制、特殊约束等
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

The raw API entry point can exceed the scope of registered commands

Source references: 5
What we found

When existing commands are insufficient, the Skill permits GET, POST, PUT, or DELETE requests to any discovered `/open-apis/<path>`. This is a general authenticated API entry point rather than one constrained to the registered command set. Confirmation is required for writes and deletes, but dry-run is only recommended and may not be supported.

Why this matters

If the agent selects the wrong endpoint, parameters, identity, or tenant, sufficiently privileged credentials could add members, change announcements, or perform more sensitive organization-level modifications or deletions.

The stated purpose is to use the generic `lark-cli api` interface when registered commands are insufficient, including POST, PUT, and DELETE operations that can change or remove Lark data. This does not bypass the account’s or app’s Lark permissions, but it does bypass the functional boundary provided by the CLI’s registered command set, so a wrong path, parameter, or target could affect data accessible to the user. Confirmation is required and dry-run is suggested, reducing risk, but dry-run is optional and may be unsupported. Users can ask how credentials, tenant boundaries, and scopes are enforced and require the exact target and request body before every mutation.

SKILL.md:81In the instructionsOpen original file
使用 `lark-cli api` 裸调：```bash# GET 请求lark-cli api GET /open-apis/<path> --params '{"key":"value"}'# POST 请求lark-cli api POST /open-apis/<path> --data '{"key":"value"}'# PUT 请求lark-cli api PUT /open-apis/<path> --data '{"key":"value"}'# DELETE 请求lark-cli api DELETE /open-apis/<path>```
Show 4 other places
SKILL.md:112In the instructionsOpen original file
- **写入/删除类 API**（POST/PUT/DELETE）调用前必须确认用户意图- 建议先用 `--dry-run` 预览请求（如支持）- 不要猜测 API 路径或参数——必须从文档中获取确认- 涉及敏感操作（删除群、移除成员等）时，向用户说明影响范围
SKILL.md:129In the instructionsOpen original file
# Step 5: 调用lark-cli api POST /open-apis/im/v1/chats/oc_xxx/members \  --data '{"id_list":["ou_xxx","ou_yyy"]}' \  --params '{"member_id_type":"open_id"}'```
SKILL.md:145In the instructionsOpen original file
# Step 5: 调用lark-cli api PATCH /open-apis/im/v1/chats/oc_xxx/announcement \  --data '{"revision":"0","requests":["<html>公告内容</html>"]}'```
SKILL.md:14In the instructionsOpen original file
当用户的需求**无法被现有 skill 或 CLI 已注册 API 覆盖**时，使用本技能从飞书官方 markdown 文档库中逐层挖掘原生 OpenAPI 接口，然后通过 `lark-cli api` 裸调完成任务。
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

The Skill first checks existing lark-cli commands. When existing wrappers are insufficient, it searches Feishu or Lark's official documentation step by step, then invokes the native endpoint through the authenticated `lark-cli api` interface.

View source
SKILL.md:37In the instructionsOpen original file
严格按以下步骤逐层检索，**不要跳步或猜测 API**：### Step 1：确认现有能力不足```bash# 先检查是否已有对应的 skill 或已注册 APIlark-cli <可能的service> --help```如果已有对应命令或 shortcut，直接使用，**不需要继续挖掘**。
SKILL.md:70In the instructionsOpen original file
### Step 4：获取 API 完整规范用 WebFetch 获取具体 API 文档，提取完整的调用规范：```WebFetch https://open.feishu.cn/document/server-docs/.../<api>.md  → 提取问题："返回完整 API 规范：HTTP 方法、URL 路径、路径参数、查询参数、请求体字段（名称/类型/必填/说明）、响应字段、所需权限、错误码"```
SKILL.md:79In the instructionsOpen original file
### Step 5：通过 CLI 调用 API使用 `lark-cli api` 裸调：```bash# GET 请求lark-cli api GET /open-apis/<path> --params '{"key":"value"}'

The Skill explicitly requires confirmation before write or delete calls, recommends a dry run when supported, and requires explaining the scope of sensitive actions such as deleting groups or removing members.

View source
SKILL.md:110In the instructionsOpen original file
## 安全规则- **写入/删除类 API**（POST/PUT/DELETE）调用前必须确认用户意图- 建议先用 `--dry-run` 预览请求（如支持）- 不要猜测 API 路径或参数——必须从文档中获取确认- 涉及敏感操作（删除群、移除成员等）时，向用户说明影响范围

Authentication, identity switching, and additional security rules are delegated to a neighboring `lark-shared` Skill. That file is not included in the supplied evidence, so its controls over tokens, tenants, or identities cannot be verified here.

View source
SKILL.md:12In the instructionsOpen original file
> **前置条件：** 先阅读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md) 了解认证、身份切换和安全规则。
Start here · InstructionsSKILL.md
lark-openapi-explorer
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:30In the instructionsOpen original file
|------|----------|| 飞书 (Feishu) | `https://open.feishu.cn/llms.txt` || Lark | `https://open.larksuite.com/llms.txt` |
SKILL.md:31In the instructionsOpen original file
| 飞书 (Feishu) | `https://open.feishu.cn/llms.txt` || Lark | `https://open.larksuite.com/llms.txt` |
SKILL.md:53In the instructionsOpen original file
```WebFetch https://open.feishu.cn/llms.txt  → 提取问题："列出所有模块文档链接，找出与 <用户需求关键词> 相关的链接"
Run commands
SKILL.md:41In the instructionsOpen original file
```bash# 先检查是否已有对应的 skill 或已注册 API
SKILL.md:83In the instructionsOpen original file
```bash# GET 请求
SKILL.md:121In the instructionsOpen original file
```bash# Step 1: 确认 CLI 没有封装
Lines read
154
File checksum (to compare versions)
d49992685d332e52cd18178ae94ab835ae46041582c1445a8af50f16a7a6b0c4