Skip to content
Report library
Purpose / Data analysis

Lark Task Skill Security Audit

What the author says it does (original text)

飞书任务:管理任务、清单和任务智能体。创建待办任务、查看和更新任务状态、拆分子任务、组织任务清单、分配协作成员、上传任务附件、注册或注销任务智能体、更新任务智能体的主页数据、写入智能体任务记录。当用户需要创建待办事项、查看任务列表、跟踪任务进度、管理项目清单或给他人分配任务、为任务上传附件文件、注册注销任务智能体、更新智能体主页数据、写入任务记录时使用。

Independent security check

Security risks found

Files checked
18
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

New tasks are forcibly assigned to the current user when no assignee is specified

Source references: 3
What we found

The creation workflow interprets ordinary requests such as “help me create a task” as requiring the current logged-in user to be the assignee, even when the user only asked for creation and did not choose an assignee. It retrieves the current user's open_id and writes it into the task.

Why this matters

The task may unexpectedly enter the user's assigned workload, changing responsibility, task lists, reminders, and teammates' understanding of ownership.

The risk is supported, though narrower than the title: for phrases such as “create a task for me” or ordinary “help me create a task,” the workflow assigns the logged-in user even when no assignee was explicitly chosen, retrieving and writing that user's open_id. This may create an unintended assignment and notifications. The document also requires confirming task details and intent before writing; users can ask that the assignee always require explicit confirmation or preview via dry-run.

references/lark-task-create.md:57In the instructionsOpen original file
1. Confirm with the user: task summary, due date, assignee, and tasklist if necessary.   - **Crucial Rule for Assignee**: If the user explicitly or implicitly says "create a task for me" (给我创建一个任务), or "help me create a task" (帮我新建/创建一个任务), you MUST assign the task to the current logged-in user. You can get the current user's `open_id` by executing `lark-cli auth status` (it already outputs JSON by default, so do not add `--json`) or `lark-cli contact +get-user` first, extracting `.identities.user.openId` (from `auth status`) or `.data.user.open_id` (from `contact +get-user`), and then passing it to the `--assignee` parameter.2. Execute `lark-cli task +create --summary "..." ...`3. Judge success by `ok == true` in the stdout JSON (the success envelope has no `code` field — do not test `code == 0`), then report the result: task ID (`data.guid`) and summary.
Show 2 other places
references/lark-task-create.md:43In the instructionsOpen original file
| `--description <text>` | No | Detailed description of the task || `--assignee <id>` | No | Assignee ID. Use user `open_id` like `ou_xxx` for people, or app ID like `cli_xxx` for apps. || `--follower <id>` | No | Follower ID. Use user `open_id` like `ou_xxx` for people, or app ID like `cli_xxx` for apps. |
references/lark-task-create.md:75In the instructionsOpen original file
> [!CAUTION]> This is a **Write Operation** -- You must confirm the user's intent before executing.

Inside this skill

3 instruction sections

This Skill uses `lark-cli` to manage Lark tasks, tasklists, members, attachments, custom fields, and task agents. It can both read data and create, update, or delete cloud objects.

View source
SKILL.md:89In the instructionsOpen original file
### tasks  - `create` — 创建任务  - `delete` — 删除任务  - `get` — 获取任务详情  - `list` — 列取任务列表  - `patch` — 更新任务### tasklists  - `add_members` — 添加清单成员  - `create` — 创建清单  - `delete` — 删除清单  - `get` — 获取清单详情  - `list` — 获取清单列表  - `patch` — 更新清单  - `remove_members` — 移除清单成员  - `tasks` — 获取清单任务列表

The reference workflows generally require confirming the target and content before writes. Attachment uploads are additionally limited to one relative-path file inside the current working directory, no larger than 50 MB.

View source
references/lark-task-update.md:35In the instructionsOpen original file
1. Confirm with the user the tasks to update and the fields.2. Execute `lark-cli task +update --task-id "..." ...`3. Read `data.updated_fields` and `data.tasks[].confirmed` from the result and report only the fields confirmed by the server.4. Do not routinely call `task tasks get` after the update when `confirmed` already contains the required state. Query details only if a required field is absent or the user explicitly asks for a full verification.> [!CAUTION]> This is a **Write Operation** -- You must confirm the user's intent before executing.
references/lark-task-upload-attachment.md:38In the instructionsOpen original file
|-----------|----------|-------------|| `--resource-id <guid_or_applink>` | Yes | Target resource GUID. Accepts a raw task GUID or a Feishu task applink URL (`.../client/todo/task?guid=...`); the `guid` query parameter is extracted automatically. Do not use `suite_entity_num` / display IDs like `t104121`. || `--file <path>` | Yes | Local file path to upload. Must be a relative path within the current working directory; absolute paths and paths escaping the cwd are rejected. Single file only, ≤ 50 MB. || `--resource-type <type>` | No | Owning resource type. Defaults to `task`. Use `task_delivery` when uploading to task agents. || `--user-id-type <type>` | No | User ID type for the request. Defaults to `open_id`. |## Workflow1. Confirm the target task GUID (or applink) and the local file path with the user.2. Ensure the file is within the current working directory and its size is ≤ 50 MB; otherwise ask the user to move/split the file.3. Determine if this is a task agent: if yes, add `--resource-type task_delivery`.

The Skill requires reading shared authentication and security instructions outside this package. That file is not included in the supplied source, so the actual authentication, token handling, and global security rules cannot be verified from this material.

View source
SKILL.md:13In the instructionsOpen original file
**CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md),其中包含认证、权限处理**
references/lark-task-create.md:81In the instructionsOpen original file
- [lark-task](../SKILL.md) -- All task commands- [lark-shared](../../lark-shared/SKILL.md) -- Authentication and global parameters

The listed permissions cover task, tasklist, section, and custom-field reads/writes, plus agent registration and task-record writes. Users should grant only the scopes needed for their intended operations.

View source
SKILL.md:154In the instructionsOpen original file
|------|-----------|| `tasks.create` | `task:task:write` || `tasks.delete` | `task:task:write` || `tasks.get` | `task:task:read` || `tasks.list` | `task:task:read` || `tasks.patch` | `task:task:write` || `tasklists.add_members` | `task:tasklist:write` || `tasklists.create` | `task:tasklist:write` || `tasklists.delete` | `task:tasklist:write` || `tasklists.get` | `task:tasklist:read` || `tasklists.list` | `task:tasklist:read` || `tasklists.patch` | `task:tasklist:write` || `tasklists.remove_members` | `task:tasklist:write` || `tasklists.tasks` | `task:tasklist:read` || `subtasks.create` | `task:task:write` |
SKILL.md:171In the instructionsOpen original file
| `members.remove` | `task:task:write` || `sections.create` | `task:section:write` || `sections.delete` | `task:section:write` || `sections.get` | `task:section:read` || `sections.list` | `task:section:read` || `sections.patch` | `task:section:write` || `sections.tasks` | `task:section:read` || `custom_fields.create` | `task:custom_field:write` || `custom_fields.get` | `task:custom_field:read` || `custom_fields.patch` | `task:custom_field:write` || `custom_fields.list` | `task:custom_field:read` || `custom_fields.add` | `task:custom_field:write` || `custom_fields.remove` | `task:custom_field:write` || `custom_field_options.create` | `task:custom_field:write` || `custom_field_options.patch` | `task:custom_field:write` || `agent.update_agent_profile` | `task:task:write` || `agent.register_agent` | `task:task:write` || `agent_task_step_info.append_task_steps` | `task:task:write` |
Start here · InstructionsSKILL.md
lark-task
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 18
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records18 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/lark-task-assign.mdFull text included
  • references/lark-task-comment.mdFull text included
  • references/lark-task-complete.mdFull text included
  • references/lark-task-create.mdFull text included
  • references/lark-task-followers.mdFull text included
  • references/lark-task-get-my-tasks.mdFull text included
  • references/lark-task-get-related-tasks.mdFull text included
  • references/lark-task-reminder.mdFull text included
  • references/lark-task-reopen.mdFull text included
  • references/lark-task-search.mdFull text included
  • references/lark-task-set-ancestor.mdFull text included
  • references/lark-task-tasklist-create.mdFull text included
  • references/lark-task-tasklist-members.mdFull text included
  • references/lark-task-tasklist-search.mdFull text included
  • references/lark-task-tasklist-task-add.mdFull text included
  • references/lark-task-update.mdFull text included
  • references/lark-task-upload-attachment.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-task-assign.mdSupporting file
  • references/lark-task-comment.mdSupporting file
  • references/lark-task-complete.mdSupporting file
  • references/lark-task-create.mdSupporting file
  • references/lark-task-followers.mdSupporting file
  • references/lark-task-get-my-tasks.mdSupporting file
  • references/lark-task-get-related-tasks.mdSupporting file
  • references/lark-task-reminder.mdSupporting file
  • references/lark-task-reopen.mdSupporting file
  • references/lark-task-search.mdSupporting file
  • references/lark-task-set-ancestor.mdSupporting file
  • references/lark-task-tasklist-create.mdSupporting file
  • references/lark-task-tasklist-members.mdSupporting file
  • references/lark-task-tasklist-search.mdSupporting file
  • references/lark-task-tasklist-task-add.mdSupporting file
  • references/lark-task-update.mdSupporting file
  • references/lark-task-upload-attachment.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:17In the instructionsOpen original file
执行任何 Task 命令前,必须先确认能力真实存在,禁止根据用户意图自行拼接或猜测 `+<verb>`:
SKILL.md:82In the instructionsOpen original file
```bashlark-cli schema task.<resource>.<method>   # 调用 API 前必须先查看参数结构
references/lark-task-assign.md:9In the instructionsOpen original file
```bash# Add an assignee
Connect to websites
references/lark-task-complete.md:14In the instructionsOpen original file
# A task applink is accepted directly; the CLI extracts its guid query valuelark-cli task +complete --task-id "https://applink.larksuite.com/client/todo/task?guid=<task_guid>"```
references/lark-task-create.md:16In the instructionsOpen original file
  --due "2026-03-25" \  --tasklist-id "https://applink.larkoffice.com/client/todo/task_list?guid=a4b00000-000-000-000-00000000036c"
references/lark-task-create.md:70In the instructionsOpen original file
    "guid": "e297d3d0-4b60-4a5f-a4d4-xxxxxxxxxxxx",    "url": "https://applink.larkoffice.com/client/todo/detail?guid=e297d3d0-4b60-4a5f-a4d4-xxxxxxxxxxxx"  }
Lines read
915
File checksum (to compare versions)
218597d48acb20a6ccd731f40b2e0fa9e0b9bea59111adb6b32f80b8090e676c