Skip to content
skillsafebeta
← Report library
Purpose / Other

Lark Shared Skill Security Audit

What the author says it does (original text)

Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing scopes, revoking authorization, or handling _notice JSON.

Independent security check

Security risks found

Files checked
7
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Authentication-status replies are instructed to include user identifiers and granted scopes

Source references: 1
What we found

The guide tells the agent to quote userName, openId, tokenStatus, and scope when answering a login-status request. openId is a stable account identifier and scopes reveal the application's capabilities; most “am I logged in?” checks do not require these details.

Why this matters

If the conversation is shared, logged, or forwarded, another person could learn an account identifier and its authorization footprint. The text does not require consent or redaction before displaying them.

The rule requires authentication-status answers to include userName, the stable account identifier openId, token status, and the full scope list. If the user only asks whether they are logged in, this may unnecessarily expose those fields in shared chats, logs, or screenshots. Users can ask that the default response show only identity, verified, and an overall status, with identifiers and scopes shown only for explicitly requested diagnostics.

references/lark-shared-identity-and-permissions.md:10In the instructionsOpen original file
| 指定单个 scope 授权 | `lark-cli auth login --scope "<scope>" --no-wait --json` || 检查当前登录态、是谁登录、token 是否有效 | `lark-cli auth status --json --verify`；回答时引用 `identity`、`verified`、`identities.user.status`、`identities.user.userName`、`identities.user.openId`（用户 open id）、`identities.user.tokenStatus`、`identities.user.scope` || 快速查看当前身份状态 | `lark-cli whoami`；实际生效的那一个身份 |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Low risk

The recommended updater replaces both the CLI and AI Skills together

Source references: 1
What we found

The update guide says `lark-cli update` updates both the executable tool and AI Skills, rather than only the component mentioned by a notice. Skills affect instructions followed in later agent sessions, so this is a broader persistent change than a routine notification.

Why this matters

Command behavior and agent instructions may change together. An incompatible or compromised release could therefore affect future related tasks. The supplied text provides no version pinning, change preview, or rollback procedure.

The instructions explicitly require `lark-cli update` and state that it updates both the CLI and AI Skills. A user running it to address a CLI update notice would therefore also persistently replace Skills that influence later agent behavior. It is not silently auto-executed: the rule only says to tell the user they can run it after completing the current task. Before running it, users can ask about separate component updates, version pinning, a change list, and rollback support.

references/lark-shared-update-notice.md:13In the instructionsOpen original file
当你在输出中看到 `_notice.update` 时，先完成用户当前请求；如仍相关，再简短告知可运行：```bashlark-cli update```**重要**：始终使用 `lark-cli update` 更新，它会同时更新 CLI 和 AI Skills。
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 2
Medium risk

The “all permissions” shortcut can grant access far beyond the current task

Source references: 4
What we found

The guide presents `--domain all` as the preferred command for obtaining all permissions. Although another section recommends minimum single-scope authorization, the table still provides a path that requests every business domain at once.

Why this matters

After approval, the CLI may gain user-level access across personal-resource domains such as calendars, documents, and drive storage. This increases the consequences of later mistakes or credential exposure.

Legitimate use of this code

`--domain all` is mapped specifically to an explicit user intent to obtain all permissions; it is not the default for every authentication task. The same table provides business-domain and single-scope authorization, and later text recommends a single missing scope under least privilege. The cited command is broad, but the visible context does not direct the agent to prefer it for ordinary tasks.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/lark-shared-identity-and-permissions.md:7In the instructionsOpen original file
|---|---|| 获取全部权限 | `lark-cli auth login --domain all --no-wait --json` || 按业务域授权 | `lark-cli auth login --domain docs --domain drive --no-wait --json`；`--domain` 可重复，也可用逗号分隔 || 指定单个 scope 授权 | `lark-cli auth login --scope "<scope>" --no-wait --json` || 检查当前登录态、是谁登录、token 是否有效 | `lark-cli auth status --json --verify`；回答时引用 `identity`、`verified`、`identities.user.status`、`identities.user.userName`、`identities.user.openId`（用户 open id）、`identities.user.tokenStatus`、`identities.user.scope` |
Show 3 other places
references/lark-shared-identity-and-permissions.md:29In the instructionsOpen original file
|------|------|---------|---------|| user 用户身份 | `--as user` | `lark-cli auth login` 等 | 访问用户自己的资源（日历、云空间/云盘/云存储等） || bot 应用身份 | `--as bot` | 自动，只需 appId + appSecret | 应用级操作,访问bot自己的资源 |
references/lark-shared-identity-and-permissions.md:61In the instructionsOpen original file
```bashlark-cli auth login --domain <domain> --no-wait --json          # 按业务域发起授权lark-cli auth login --scope "<missing_scope>" --no-wait --json  # 按具体 scope 发起授权（推荐，符合最小权限原则）```**规则**：auth login 必须指定范围（`--scope`、`--domain` 或 `--recommend`）。多次 login 的 scope 会累积（增量授权）。
references/lark-shared-identity-and-permissions.md:60In the instructionsOpen original file
```bashlark-cli auth login --domain <domain> --no-wait --json          # 按业务域发起授权lark-cli auth login --scope "<missing_scope>" --no-wait --json  # 按具体 scope 发起授权（推荐，符合最小权限原则）```
Medium risk

Authorization links and QR codes placed in chat may be used by an unintended person

Source references: 5
What we found

The guide requires displaying the verification URL and QR code in the conversation, then completing login in a later turn with the associated device code. If these short-lived authorization materials appear in a shared chat, recording, or visible notification, another person may authorize first.

Why this matters

The CLI could become bound to the wrong Lark account, after which the agent may read or modify resources under an unintended identity. The guide avoids reusing expired codes but does not require post-login identity verification.

The flow requires displaying the verification URL and its QR code in chat, then having the agent complete login with the corresponding device_code. If another person can see the session, notification, or screen, they may open the link and authorize first, potentially causing the agent to finish login for an unintended account. The text forbids cross-flow reuse but does not address exposure in shared sessions. Users can require private display, expiry information, and an account-identity check after completion.

SKILL.md:20In the instructionsOpen original file
3. **授权 / 配置类 URL 必须配二维码**：当命令输出 `verification_url`、`verification_uri_complete`、`console_url` 等 URL 字段时，必须用 `lark-cli auth qrcode` 生成并在回复中展示，URL 在前二维码在后；优先生成 PNG（`--output`），仅当用户明确要求时才使用 ASCII（`--ascii`）。URL 原样转发——不编解码、不加标点、不重拼 query，二维码和链接请一起展示给用户。
Show 4 other places
references/lark-shared-identity-and-permissions.md:88In the instructionsOpen original file
1. 执行 `lark-cli auth login --scope "xxx" --no-wait --json`（必须加 `--no-wait --json`）2. 从 JSON 输出中提取 `verification_url` 和 `device_code`3. 生成二维码：`lark-cli auth qrcode <verification_url> --output "xxx"`4. 将 URL 和二维码展示给用户（先 URL，后二维码）5. **结束本轮对话前，必须明确告知用户**："请完成授权后，回来告诉我已授权完成，我会帮你完成后续步骤"
references/lark-shared-identity-and-permissions.md:96In the instructionsOpen original file
1. 等待用户回复"已完成授权"2. **由你（AI agent）亲自执行**：`lark-cli auth login --device-code <device_code>`3. 此命令会轮询授权状态并完成登录4. 如果返回授权成功，流程结束
references/lark-shared-identity-and-permissions.md:94In the instructionsOpen original file
**第二步：完成授权（后续轮）**1. 等待用户回复"已完成授权"2. **由你（AI agent）亲自执行**：`lark-cli auth login --device-code <device_code>`3. 此命令会轮询授权状态并完成登录4. 如果返回授权成功，流程结束
references/lark-shared-identity-and-permissions.md:103In the instructionsOpen original file
- **你必须亲自执行 `--device-code` 命令**，不要指示用户自行执行- **不要在同一轮中展示 URL 后立刻执行 `--device-code`**，这会导致用户看不到 URL- **禁止跨流程缓存 `verification_url` 或 `device_code`**：每次需要重新发起授权时，必须沿用所需的 `--scope`、`--domain` 或 `--recommend` 选择以及任何 `--exclude` 值，并附加 `--no-wait --json` 生成新的链接。不要复用已过期的授权链接或 device code
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This Skill is an authentication and safety guide for lark-cli. It requires checking the user/bot identity first because user identity can access personal resources, while bot identity is limited to the application's resources.

View source
SKILL.md:18In the instructionsOpen original file
2. **身份决定你代表谁操作**：`--as user` 代表用户本人（能看到、也能操作其日历、云空间/云盘/云存储等个人资源），`--as bot` 代表应用自己，应用级操作，只能访问bot自己的资源，bot 查用户资源会返回空成功而非报错。动手前先搞清楚身份`identity`。身份模型和权限管理 → [`lark-shared-identity-and-permissions.md`](references/lark-shared-identity-and-permissions.md)。
references/lark-shared-identity-and-permissions.md:41In the instructionsOpen original file
## 身份延续- CLI命令执行时，身份选择优先级为：显式 `--as` 优先；省略时由 CLI 根据当前配置和可用凭证自动选择(可通过 `lark-cli whoami` 查看 `identity` 和选择逻辑)。- 因此，盲目省略 `--as` 是不可控的，在明确需要保持某一身份时，建议全程显式选择。

High-risk writes have an explicit approval gate: after exit 10, the agent must show the operation and parameters and wait for user consent rather than automatically adding the confirmation flag; a dry run is preferred when supported.

View source
SKILL.md:29In the instructionsOpen original file
2. **写入/删除操作前必须确认用户意图**。3. 目标命令支持 `--dry-run` 时，用 `--dry-run` 预览危险请求。4. **退出码 10 是高风险确认门禁（`risk: "high-risk-write"`），不是错误**：停下 → **向用户确认**（展示 `action`、`risk` 和关键参数）→ 取得**用户显式同意**后，将 `hint` 指出的确认 flag **追加到你原始 argv 的末尾**后重试；**绝不**静默加确认 flag 绕过 → [`lark-shared-high-risk-approval.md`](references/lark-shared-high-risk-approval.md)。
references/lark-shared-high-risk-approval.md:27In the instructionsOpen original file
**绝对不允许**：- 看到 exit 10 就默认加确认 flag 静默重试（这等于禁用门禁）- 把 `confirmation_required` 当网络错误/权限错误处理- 在用户没明确同意的前提下追加确认 flag 重试- 用 `sh -c` 等 shell 方式拼接命令重试——用参数数组（argv）形式传参，避免 shell 解析把用户参数当作语法

Authentication uses a split device-authorization flow: the agent first generates an authorization link and QR code, and after the user completes browser authorization, the agent uses the device code to finish login.

View source
references/lark-shared-identity-and-permissions.md:88In the instructionsOpen original file
1. 执行 `lark-cli auth login --scope "xxx" --no-wait --json`（必须加 `--no-wait --json`）2. 从 JSON 输出中提取 `verification_url` 和 `device_code`3. 生成二维码：`lark-cli auth qrcode <verification_url> --output "xxx"`4. 将 URL 和二维码展示给用户（先 URL，后二维码）5. **结束本轮对话前，必须明确告知用户**："请完成授权后，回来告诉我已授权完成，我会帮你完成后续步骤"
references/lark-shared-identity-and-permissions.md:94In the instructionsOpen original file
**第二步：完成授权（后续轮）**1. 等待用户回复"已完成授权"2. **由你（AI agent）亲自执行**：`lark-cli auth login --device-code <device_code>`3. 此命令会轮询授权状态并完成登录4. 如果返回授权成功，流程结束
Start here · InstructionsSKILL.md
lark-shared
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 5
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records7 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/lark-shared-config-init.mdFull text included
  • references/lark-shared-high-risk-approval.mdFull text included
  • references/lark-shared-identity-and-permissions.mdFull text included
  • references/lark-shared-output-contract.mdFull text included
  • references/lark-shared-update-notice.mdFull text included
  • references/lark-wiki-token-routing.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-shared-config-init.mdSupporting file
  • references/lark-shared-high-risk-approval.mdSupporting file
  • references/lark-shared-identity-and-permissions.mdSupporting file
  • references/lark-shared-output-contract.mdSupporting file
  • references/lark-shared-update-notice.mdSupporting file
  • references/lark-wiki-token-routing.mdSupporting file

Operations mentioned in code and instructions

Run commands
references/lark-shared-config-init.md:9In the instructionsOpen original file
```bash# 发起配置（该命令会阻塞直到用户打开链接并完成操作或过期）
references/lark-shared-identity-and-permissions.md:19In the instructionsOpen original file
```bashLARKSUITE_CLI_NO_UPDATE_NOTIFIER=1 LARKSUITE_CLI_NO_SKILLS_NOTIFIER=1 lark-cli auth status --json --verify
references/lark-shared-identity-and-permissions.md:60In the instructionsOpen original file
```bashlark-cli auth login --domain <domain> --no-wait --json          # 按业务域发起授权
Connect to websites
references/lark-wiki-token-routing.md:10In the instructionsOpen original file
```bashlark-cli drive +inspect --url 'https://xxx.feishu.cn/wiki/<wiki_token>'```
Lines read
292
File checksum (to compare versions)
6d901ee75c9516b6a44dac6db22062b421d0e166ffe0568756d0a88102660683