Lark Skill Maker Skill Security Audit
What the author says it does (original text)
创建 lark-cli 的自定义 Skill。当用户需要把飞书 API 操作封装成可复用的 Skill（包装原子 API 或编排多步流程）时使用。
No obvious risks found in this check
- Files checked
- 1
- Risks found
- 0
Inside this skill
This Skill guides an AI to write new Feishu CLI Skills. The provided material contains no script and does not direct immediate API execution. It specifies the generated artifact as skills/lark-<name>/SKILL.md.
View source
基于 lark-cli 创建新 Skill。Skill = 一份 `SKILL.md`，教 AI 用 CLI 命令完成任务。文件放在 `skills/lark-<name>/SKILL.md`：It directs the author to inspect registered lark-cli capabilities and parameter schemas first. If those are insufficient, it allows consulting Feishu's official documentation and calling unregistered endpoints through the generic API command. Actual access depends on the later generated Skill, selected endpoints, and account permissions.
View source
```bash# 1. 查看已有的 API 资源和 Shortcutlark-cli <service> --help# 2. 查参数定义lark-cli schema <service.resource.method># 3. 未注册的 API，用 api 直接调用lark-cli api GET /open-apis/vc/v1/rooms --params '{"page_size":"50"}'lark-cli api POST /open-apis/vc/v1/rooms/search --data '{"query":"5F"}'```如果以上命令无法覆盖需求（CLI 没有对应的已注册 API 或 Shortcut），使用 [lark-openapi-explorer](../lark-openapi-explorer/SKILL.md) 从飞书官方文档库逐层挖掘原生 OpenAPI 接口，获取完整的方法、路径、参数和权限信息，再通过 `lark-cli api` 裸调完成任务。通过以上流程确定需要哪些 API、参数和 scope。The template requires generated Skills to document required permissions, confirm user intent before writes, prefer a dry-run preview, and describe data flow and rollback for multi-step operations.
View source
## 权限| 操作 | 所需 scope ||------|-----------|| xxx | `scope:name` |```- **description 决定触发** — 包含功能关键词 + "当用户需要...时使用"- **认证** — 说明所需 scope，登录用 `lark-cli auth login --domain <name>`- **安全** — 写入操作前确认用户意图，建议 `--dry-run` 预览- **编排** — 说明数据传递、失败回滚、可并行步骤Files and check records1 files
Coverage and gaps
Content covered in each file
These are the source ranges included in this check, not a guarantee that every issue has been resolved.
SKILL.mdFull text included
This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.
SKILL.mdInstructions
Operations mentioned in code and instructions
Run commands
```bashlark-cli <service> <resource> <method> # 已注册 API```bash# 1. 查看已有的 API 资源和 Shortcut\```bash# 单步操作- Lines read
- 86
- File checksum (to compare versions)
- 40530a05295914d5dadd36e2f1a7e959238dddbe9764b2afeb0dd5f5bd9f8476