Skip to content
Report library
Purpose / Other

Lark Vc Skill Security Audit

What the author says it does (original text)

仅当用户或上游配置显式指定 lark-vc 时使用,相关请求统一交由 lark-meeting 技能处理。

Independent security check

Security risks found

Files checked
1
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Actual actions are determined by another skill whose contents were not supplied for audit

Source references: 3
What we found

This entry requires the agent to fully read and execute the routing and action guidance in ../lark-meeting/SKILL.md. Consequently, when a user selects lark-vc, the operative instructions are outside the reviewed content and may change with the adjacent skill.

Why this matters

If the delegated skill performs account operations, sends data, changes meetings, or assumes broader authority, the agent could carry out those actions even though the user only saw this compatibility entry. The supplied evidence does not establish whether such behavior exists.

This is a compatibility entry and does not handle the task itself. However, when lark-vc is explicitly selected, it requires the agent to read and execute the neighboring lark-meeting skill. That skill is absent from the supplied material, so its access to files, accounts, or network services—and whether those actions match user authorization—cannot be audited here. A user can ask for the complete, version-pinned lark-meeting dependency or restrict its execution until reviewed.

SKILL.md:4In the instructionsOpen original file
version: 1.0.0description: "仅当用户或上游配置显式指定 lark-vc 时使用,相关请求统一交由 lark-meeting 技能处理。"metadata:  requires:    bins: ["lark-cli"]    skills: ["lark-meeting"]---
Show 2 other places
SKILL.md:13In the instructionsOpen original file
本技能只用于兼容旧名称,不直接处理业务。**MUST 完整读取 [`../lark-meeting/SKILL.md`](../lark-meeting/SKILL.md),并按照其中的路由和行动指南执行。**
SKILL.md:8In the instructionsOpen original file
    bins: ["lark-cli"]    skills: ["lark-meeting"]---
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

1 instruction sections

This is a legacy-name compatibility entry. It says it does not handle the task itself and delegates actual handling to the adjacent lark-meeting skill.

View source
SKILL.md:11In the instructionsOpen original file
# Compatibility entry本技能只用于兼容旧名称,不直接处理业务。**MUST 完整读取 [`../lark-meeting/SKILL.md`](../lark-meeting/SKILL.md),并按照其中的路由和行动指南执行。**

Its metadata declares dependencies on the lark-cli executable and the lark-meeting skill, but the supplied material contains no command that directly invokes the executable.

View source
SKILL.md:5In the instructionsOpen original file
description: "仅当用户或上游配置显式指定 lark-vc 时使用,相关请求统一交由 lark-meeting 技能处理。"metadata:  requires:    bins: ["lark-cli"]    skills: ["lark-meeting"]---
Start here · InstructionsSKILL.md
lark-vc
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
Lines read
16
File checksum (to compare versions)
75951916f4fae6463d8cee5c066c461fdb1faacaec1ab7e0eee2427226a1d5e8