Skip to content
Report library
Purpose / Other

Lark Contact Skill Security Audit

What the author says it does (original text)

飞书 / Lark 通讯录:按姓名 / 邮箱解析成 open_id,或按 open_id 反查姓名 / 部门 / 邮箱 / 联系方式 / 个人状态 / 签名,以及按关键词搜索当前用户可见的机器人 / 智能体(agent)。当用户提到一个名字要下一步发消息 / 排日程,或拿到 open_id 想查具体信息时使用。不负责部门树遍历、按部门列员工、组织架构图,这类需求走原生 OpenAPI。

Independent security check

Security risks found

Files checked
4
Risks found
1
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Broad or batch queries can expose more colleague data than the task requires

Source references: 6
What we found

`+search-user` supports batch enrichment of up to 100 open_ids and filter-only enumeration such as all departed colleagues the user has chatted with. Results can include personal and enterprise email, department, chat ID, signature, and contact-recency hints. Although access is limited by the current account's visibility, the Skill does not require requesting or displaying only fields necessary for the immediate task.

Why this matters

Full results shown in a shared conversation, screen, or log could disclose colleagues' identities, contact details, organizational relationships, departure status, and interaction history to observers or downstream systems.

The source supports this risk. The Skill permits lookup of up to 100 open_ids and provides a filter-only command that enumerates contacts who were previously chatted with and have left the organization. Returned data can include email addresses, department, P2P chat ID, signature, and recent-contact hints. These operations fit the contact-lookup purpose and are limited by the active identity’s visibility, but no instruction requires minimizing queried or displayed fields. Broad filters or batch enrichment could therefore expose unnecessary coworker data to the user or later context. Users can ask for field minimization, no keyword-free enumeration, and confirmation before batch queries.

references/lark-contact-search-user.md:14In the instructions
`--query` / `--queries` / `--user-ids` / bool filter 至少传一个。bool filter 显式传 `=false` 会报错——不传等于不过滤。| Flag | 作用 ||---|---|| `--query <text>` | 关键词(姓名 / 邮箱 / 手机号),≤ 50 rune || `--queries <csv>` | 多个关键词并行搜,**最多 20 条**;与 `--query` / `--user-ids` 互斥;输出新 shape(见下) || `--user-ids <csv>` | open_id 列表,≤ 100;支持 `me` 表示自己;与 `--query` 同传时把搜索范围限定在该集合 || `--has-chatted` | 仅搜聊过天的 || `--has-enterprise-email` | 仅搜有企业邮箱的 || `--exclude-external-users` | 仅搜同租户(排除外部联系人) || `--left-organization` | 仅搜已离职的 || `--lang <locale>` | 覆盖 `localized_name` 的语种(如 `zh_cn` / `en_us` / `ja_jp`) |
Show 5 other places
references/lark-contact-search-user.md:46In the instructions
# filter-only 枚举:列出所有"聊过天的离职同事"(无关键词)lark-cli contact +search-user --has-chatted --left-organization```
references/lark-contact-search-user.md:100In the instructions
| `localized_name` | string | 按 `--lang` / brand 选出的展示名 | 始终非空(兜底为 open_id) || `email` | string | 个人邮箱 | 可能为空 || `enterprise_email` | string | 企业邮箱 | 可能为空 || `is_activated` | bool | 是否已激活飞书账号(未激活也可投递消息,但用户可能看不到) | 可能 false || `is_cross_tenant` | bool | 是否跨租户用户(同公司=false,外部联系人=true) | — || `p2p_chat_id` | string | 与当前用户的 P2P 会话 ID(`oc_...`);空表示从未私聊过。可作为接受 `--chat-id` 的 IM 命令的输入 | 可能为空 || `has_chatted` | bool | `p2p_chat_id != ""` 的派生字段 | — || `department` | string | 部门路径,服务端可能用 `-` 拼层级,层级数不固定。**按可子串匹配的字符串处理** | 可能为空 || `signature` | string (optional) | 用户个性签名;空时字段不出现 | 可能不出现 || `chat_recency_hint` | string | 最近联系的提示文案,仅供展示 | 可能为空 || `match_segments` | string[] | 关键词命中的字符串片段,用于高亮展示;无命中则为空数组 | — |
SKILL.md:40In the instructions
批量查同事的个人状态 / 个性签名(先用 schema 看参数)。```bashlark-cli schema contact.user_profiles.batch_querylark-cli contact user_profiles batch_query \  --params '{"user_id_type":"open_id"}' \  --data '{"user_ids":["ou_xxx","ou_yyy"],"query_option":{"include_personal_status":true,"include_description":true}}' \  --as user```
references/lark-contact-search-user.md:40In the instructions
# 批量回填:已知一组 open_id,取姓名 / 邮箱 / 部门lark-cli contact +search-user --user-ids "ou_a,ou_b,ou_c" --format json# 多 filter 组合:同租户的、有企业邮箱的「王」姓员工lark-cli contact +search-user --query "王" --exclude-external-users --has-enterprise-email# filter-only 枚举:列出所有"聊过天的离职同事"(无关键词)lark-cli contact +search-user --has-chatted --left-organization```
SKILL.md:63In the instructions
- **41050 / Permission denied** 受当前身份的可见范围限制(三条命令都可能遇到)。细节见 [`lark-shared`](../lark-shared/SKILL.md)。- **跨租户用户**(`is_cross_tenant=true`)多数业务字段为空字符串,这是飞书可见性规则,下游做空值兜底。
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

5 instruction sections

This Skill describes a contact-lookup workflow and delegates the actual operation to the external `lark-cli`. It can search people by name, email, phone number, or open_id and return an open_id usable by later actions.

View source
SKILL.md:6In the instructions
metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli contact --help"---
references/lark-contact-search-user.md:18In the instructions
|---|---|| `--query <text>` | 关键词(姓名 / 邮箱 / 手机号),≤ 50 rune || `--queries <csv>` | 多个关键词并行搜,**最多 20 条**;与 `--query` / `--user-ids` 互斥;输出新 shape(见下) || `--user-ids <csv>` | open_id 列表,≤ 100;支持 `me` 表示自己;与 `--query` 同传时把搜索范围限定在该集合 || `--has-chatted` | 仅搜聊过天的 |

People and bot searches use the current user's identity and visible scope; bot search additionally requires `search:bot`. The documentation does not claim to bypass Lark permission limits.

View source
SKILL.md:13In the instructions
**user 身份和 bot 身份是两条完全独立的路径**。先确定当前身份,再按下表选命令:| 想做什么 | user 身份 | bot 身份 ||---|---|---|| 按姓名 / 邮箱搜员工拿 open_id | [`+search-user`](references/lark-contact-search-user.md) | 不支持 || 按关键词搜索当前用户可见的机器人 / 智能体 | [`+search-bot`](references/lark-contact-search-bot.md) | 不支持 || 已知 open_id 取他人资料 | `+search-user --user-ids <id>` | [`+get-user --user-id <id>`](references/lark-contact-get-user.md) || 查看自己 | `+get-user` 或 `+search-user --user-ids me` | 不支持 || 查同事的个人状态 / 签名 | `user_profiles batch_query` | 不支持 |
references/lark-contact-search-bot.md:3In the instructions
按关键词搜索当前用户可见的机器人。仅支持 user 身份,需要 `search:bot` 权限。
SKILL.md:63In the instructions
- **41050 / Permission denied** 受当前身份的可见范围限制(三条命令都可能遇到)。细节见 [`lark-shared`](../lark-shared/SKILL.md)。- **跨租户用户**(`is_cross_tenant=true`)多数业务字段为空字符串,这是飞书可见性规则,下游做空值兜底。

Lookup is separated from sending messages or calendar invitations. The documentation requires user confirmation when multiple matches are returned, reducing the risk of acting on the wrong person or bot.

View source
SKILL.md:23In the instructions
已知 open_id 只是想发消息 / 排日程,不必经过 contact —— 直接 [`lark-im`](../lark-im/SKILL.md) / [`lark-calendar`](../lark-calendar/SKILL.md)。
SKILL.md:50In the instructions
搜索命中多条且后续操作有副作用(发消息、邀请会议等),把候选列给用户挑;不要擅自选第一条。
references/lark-contact-search-bot.md:46In the instructions
命中多个机器人时,结合 `description` 和 `is_agent` 判断。后续要发消息或拉群时,让用户确认目标,不要直接选择第一条。
Start here · InstructionsSKILL.md
lark-contact
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 3
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/lark-contact-get-user.mdFull text included
  • references/lark-contact-search-bot.mdFull text included
  • references/lark-contact-search-user.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-contact-get-user.mdSupporting file
  • references/lark-contact-search-bot.mdSupporting file
  • references/lark-contact-search-user.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:35In the instructions
```bashlark-cli contact +search-user --query "张三" --has-chatted --as user
SKILL.md:42In the instructions
```bashlark-cli schema contact.user_profiles.batch_query
SKILL.md:56In the instructions
```bashlark-cli contact +search-bot --query '会议助手' --as user
Lines read
277
File checksum (to compare versions)
b22e738a119adef294bf92756f7afec97cebdc25bee76f0d52985ddbfde9fa6c