Lark Calendar Skill Security Audit

When creating or updating a description, a relative local image path inside the current working directory triggers an automatic cloud-drive upload; descriptions can also be read from `@file-path` or stdin. If the agent places a supplied or generated path into the description, workspace file contents could be read and uploaded. The path is confined to the working directory, but no per-file confirmation is required. Users can ask that every local path be shown and separately approved before reading or upload.

These are active workflow instructions requiring ambiguous attendee selections and clarified time meanings to be stored as long-term memory or preferences. The source does not state where this is stored, how long it is retained, or require consent before saving, so a one-time calendar conversation could create a persistent profile. Users can require long-term memory to be disabled or demand disclosure and confirmation before each saved item.

The `+create` documentation says it automatically lets attendees see one another and edit the event, and also adds a Lark video meeting by default. These are default command effects, not merely examples; a user asking only to create an event and invite people may grant broader editing rights than expected. Users can ask for explicit controls to restrict attendee permissions and disable video meetings, with final settings shown before creation.

For recurring events, the instructions require checking the room’s reservation limit and automatically shortening the recurrence end date if the user confirms continued use of a room whose limit is too short. The limit must first be disclosed, so this is not entirely silent, but confirming a room also authorizes truncating the event series. Users can require separate confirmations for room selection and recurrence changes, including a list of dates that would be removed.

Combined updates write fields, removals, and additions sequentially, and a later failure does not undo earlier successful steps, so an event can remain partially updated. The error reports completed steps, reducing silent-failure risk, and the top-level rule permits rechecking when output is insufficient. However, no follow-up query is performed by default, so final-state knowledge usually relies on CLI output. Users can require previews and, after partial failure, a report of completed changes before any repair or rollback.

Transfer is a high-sensitivity write requiring `--yes` and is explicitly described as irreversible; associated meeting notes, notes, and attachments are transferred as well. For recurring events, the backend transfers the whole series rather than one instance, but `--transfer-series` is required and omission causes failure pending confirmation, which is a meaningful safeguard. Users should still verify the recipient, series scope, and attached materials before approval and can request `--dry-run` first.