Skip to content
Report library
Purpose / Documents

Lark Markdown Skill Security Audit

What the author says it does (original text)

飞书 Markdown:查看、创建、上传、编辑和比较飞书中的原生 Markdown 文件。当用户要操作飞书 Markdown 文件,或比较其远端版本及本地草稿时使用。纯本地 Markdown 文件操作不触发本 skill。不负责将 Markdown 导入为飞书在线文档,也不负责文件搜索、权限、评论、移动、删除等云空间管理操作。

Independent security check

Security risks found

Files checked
6
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 3
Medium risk

A partial patch can overwrite concurrent edits or replace every matching location

Source references: 3
What we found

This is not an atomic patch: it downloads the full file, runs `ReplaceAll` or a whole-document regex replacement, then uploads a complete overwrite. There is no stated concurrency guard, and the result reports only a match count rather than locations.

Why this matters

Content submitted by someone else during that interval may be silently lost. An overly broad literal or regex pattern can also alter multiple unintended parts of the document.

The documentation confirms that patch applies replacement across the entire Markdown and is implemented as download, local replacement, then whole-file overwrite. If someone edits the file after download, the upload may overwrite that edit; an overly broad literal or regex pattern can also replace every match. Only a match count is returned, not locations. Users can require `--dry-run`, narrowly scoped patterns, and no concurrent editing of collaborative files.

references/lark-markdown-patch.md:71In the instructions
- `--content` 必须显式传入,但允许为空字符串- 未加 `--regex` 时,行为等价于对整份 Markdown 文本执行 `strings.ReplaceAll`- 加了 `--regex` 时,行为等价于对整份 Markdown 文本执行 RE2 全量替换;`--content` 里的 `$1`、`${name}` 会按 Go regexp replacement template 解释,字面 `$` 请写成 `$$`- 替换后的最终 Markdown 不能为空;如果 patch 结果是空字符串,CLI 会直接报错,不会上传空文件,因为 Drive 不支持零字节 Markdown,且空文件通常是误操作- `0` 命中时命令仍然成功返回,但不会上传新版本
Show 2 other places
references/lark-markdown-patch.md:96In the instructions
- 该命令的内部语义是:**download -> local replace -> overwrite upload**- 它不是服务端原子 patch;如果有人在你下载后、上传前更新了同一文件,本次 patch 仍可能覆盖那次中间修改- 它不会返回详细匹配位置,只返回命中数量- `--dry-run` 会同时展示两种可能的上传路径:`upload_all`(小文件)和 `upload_prepare/upload_part/upload_finish`(大文件分片上传)
references/lark-markdown-patch.md:49In the instructions
# 预览底层编排lark-cli markdown +patch \  --file-token boxcnxxxx \  --pattern 'hello markdown' \  --content 'hello patched' \  --dry-run```
Medium risk

Overwriting from a local file also changes the remote filename by default

Source references: 3
What we found

When `+overwrite` uses `--file` without `--name`, the remote file adopts the local filename. This goes beyond merely replacing its contents.

Why this matters

People, documentation, or automation that rely on the original filename may no longer recognize the file, while the user may believe only the content was updated.

The documentation explicitly states that when `--file` is used without `--name`, the overwritten remote file defaults to the local filename. The operation can therefore change both content and name, affecting display, identification, or name-dependent workflows. Supplying `--name` controls the resulting name; users can require preservation of the remote name or confirmation before renaming.

references/lark-markdown-overwrite.md:55In the instructions
- `--content` 与 `--file` 必须二选一- 如果传了 `--name`,直接使用它作为覆盖后的文件名- 如果没传 `--name` 且使用 `--content`,默认保留远端原文件名- 如果没传 `--name` 且使用 `--file`,默认使用本地文件名- `--file` 指向的本地文件名必须带 `.md` 后缀- 覆盖成功后 **必须** 返回 `version`
Show 2 other places
references/lark-markdown-overwrite.md:48In the instructions
|------|------|------|| `--file-token` | 是 | 目标 Markdown 文件 token || `--name` | 否 | 显式指定覆盖后的文件名;必须带 `.md` 后缀。传入时优先使用它 || `--content` | 条件必填 | 新 Markdown 内容;与 `--file` 互斥;支持直接传字符串、`@file`、`-`(stdin) || `--file` | 条件必填 | 本地 `.md` 文件路径;与 `--content` 互斥 |
references/lark-markdown-overwrite.md:56In the instructions
- `--content` 与 `--file` 必须二选一- 如果传了 `--name`,直接使用它作为覆盖后的文件名- 如果没传 `--name` 且使用 `--content`,默认保留远端原文件名- 如果没传 `--name` 且使用 `--file`,默认使用本地文件名- `--file` 指向的本地文件名必须带 `.md` 后缀- 覆盖成功后 **必须** 返回 `version`
Low risk

The optional fetch overwrite flag replaces an existing local file

Source references: 2
What we found

`+fetch` can save remote content locally. With `--overwrite`, it replaces an existing file at the selected path, and the documentation does not describe creating a backup.

Why this matters

An incorrect output path can destroy uncommitted or otherwise unbacked-up local Markdown content.

Legitimate use of this code

Local replacement is an explicit, optional `--overwrite` behavior that only applies with `--output`; ordinary fetch can return content directly or save to a nonexisting destination. The cited source does not show silent overwriting, automatic insertion of the flag, or bypassing confirmation, so this is a clearly labeled normal download option with destructive potential. Users can still require that `--overwrite` not be used or that the destination be confirmed; no backup is promised.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
references/lark-markdown-fetch.md:23In the instructions
# 覆盖已存在文件lark-cli markdown +fetch \  --file-token boxcnxxxx \  --output ./README.md \  --overwrite
Show 1 other places
references/lark-markdown-fetch.md:40In the instructions
|------|------|------|| `--file-token` | 是 | 目标 Markdown 文件 token || `--output` | 否 | 本地保存路径;既可传具体文件名,也可传目录路径。传目录时使用远端文件名保存;省略时直接返回 Markdown 内容 || `--overwrite` | 否 | 覆盖已存在的本地输出文件;仅在传入 `--output` 时生效 |
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Bot-created files trigger an attempted full-access grant to the current CLI user

Source references: 4
What we found

After a successful `--as bot` creation, the CLI does more than create the file: it attempts to grant `full_access` to the locally recorded current CLI user. A request to create a file does not necessarily authorize adding a permission manager.

Why this matters

That CLI user can manage the file's permissions. If the stored `open_id` belongs to the wrong, stale, or shared-environment account, control may be granted to an unintended person.

The documentation says that after a successful `--as bot` creation, the CLI attempts to grant `full_access` to the locally recorded current CLI user. This is an additional permission change that can let that identity manage the file, though the grant may be skipped or fail. A user can require disclosure of the grantee before creation or avoid bot identity. The separate prohibition on unconfirmed owner transfer shows this is not an ownership transfer.

references/lark-markdown-create.md:91In the instructions
> [!IMPORTANT]> 如果 Markdown 文件是**以应用身份(bot)创建**的,如 `lark-cli markdown +create --as bot`,在创建成功后,CLI 会**尝试为当前 CLI 用户自动授予该文件的 `full_access`(可管理权限)**。>> 以应用身份创建时,结果里会额外返回 `permission_grant` 字段,明确说明授权结果:> - `status = granted`:当前 CLI 用户已获得该文件的可管理权限> - `status = skipped`:本地没有可用的当前用户 `open_id`,因此不会自动授权;可提示用户先完成 `lark-cli auth login`,再让 AI / agent 继续使用应用身份(bot)授予当前用户权限> - `status = failed`:Markdown 文件已创建成功,但自动授权用户失败;会带上失败原因,并提示稍后重试或继续使用 bot 身份处理该文件>> `permission_grant.perm = full_access` 表示该资源已授予“可管理权限”。>
Show 3 other places
references/lark-markdown-create.md:92In the instructions
> [!IMPORTANT]> 如果 Markdown 文件是**以应用身份(bot)创建**的,如 `lark-cli markdown +create --as bot`,在创建成功后,CLI 会**尝试为当前 CLI 用户自动授予该文件的 `full_access`(可管理权限)**。>
references/lark-markdown-create.md:94In the instructions
>> 以应用身份创建时,结果里会额外返回 `permission_grant` 字段,明确说明授权结果:> - `status = granted`:当前 CLI 用户已获得该文件的可管理权限> - `status = skipped`:本地没有可用的当前用户 `open_id`,因此不会自动授权;可提示用户先完成 `lark-cli auth login`,再让 AI / agent 继续使用应用身份(bot)授予当前用户权限> - `status = failed`:Markdown 文件已创建成功,但自动授权用户失败;会带上失败原因,并提示稍后重试或继续使用 bot 身份处理该文件>
references/lark-markdown-create.md:101In the instructions
>> **不要擅自执行 owner 转移。** 如果用户需要把 owner 转给自己,必须单独确认。
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

This Skill uses `lark-cli` to read, create, compare, and modify native Markdown files in Lark Drive. It prefers user identity but permits bot identity for automation.

View source
SKILL.md:17In the instructions
- 身份:Markdown 文件通常属于用户云空间资源,优先使用 `--as user`。如为自动化场景,或应用已创建并持有目标文件权限,可按场景使用 `--as bot`。首次以 `user` 身份访问前执行 `lark-cli auth login`- `markdown +create` / `+overwrite` 失败时,先判断是不是身份和权限问题:`bot` 更常见的是 app scope 或目标目录 ACL,`user` 更常见的是用户授权或用户 ACL;不要不加判断地来回切身份重试。
SKILL.md:20In the instructions
- 用户要**上传、创建一个原生 `.md` 文件**,使用 `lark-cli markdown +create`- 用户要**比较原生 `.md` 文件的历史版本差异**,或比较远端 Markdown 与本地草稿,使用 `lark-cli markdown +diff`- 用户要**读取 Drive 里某个 `.md` 文件内容**,使用 `lark-cli markdown +fetch`- 用户要对 Markdown 文件做**局部文本替换 / 正则替换**,优先使用 `lark-cli markdown +patch`- 用户要**覆盖更新 Drive 里某个 `.md` 文件内容**,使用 `lark-cli markdown +overwrite`- 用户要先拿 Markdown 文件的历史版本号,再做比较/下载/回滚,先用 [`lark-drive`](../lark-drive/SKILL.md) 的 `lark-cli drive +version-history`

Create and overwrite operations can read a specified local file, an `@file`, or standard input and write that content to Lark as Markdown.

View source
SKILL.md:35In the instructions
- `--name` 和本地 `--file` 文件名都必须显式带 `.md` 后缀;不满足时 shortcut 会直接报错- `--content` 支持:  - 直接传字符串  - `@file` 从本地文件读取内容  - `-` 从 stdin 读取内容- `markdown +patch` 的内部语义是:**先完整下载 Markdown,再本地替换,再整文件覆盖上传**
references/lark-markdown-create.md:63In the instructions
| `--wiki-token` | 否 | 目标 wiki 节点 token 或 wiki URL;与 `--folder-token` 互斥;传入后自动映射为 `parent_type=wiki` || `--name` | 条件必填 | 文件名,**必须显式带 `.md` 后缀**;使用 `--content` 时必填;使用 `--file` 时可省略,默认取本地文件名 || `--content` | 条件必填 | Markdown 内容;与 `--file` 互斥;支持直接传字符串、`@file`、`-`(stdin) || `--file` | 条件必填 | 本地 `.md` 文件路径;与 `--content` 互斥 |

Fetch returns the remote text by default or can save it to a chosen local path; an existing local file is replaced only when `--overwrite` is explicitly used.

View source
references/lark-markdown-fetch.md:40In the instructions
|------|------|------|| `--file-token` | 是 | 目标 Markdown 文件 token || `--output` | 否 | 本地保存路径;既可传具体文件名,也可传目录路径。传目录时使用远端文件名保存;省略时直接返回 Markdown 内容 || `--overwrite` | 否 | 覆盖已存在的本地输出文件;仅在传入 `--output` 时生效 |

The apparent partial patch actually downloads the entire remote file, performs a local global replacement, and uploads the whole file; it is not an atomic server-side update.

View source
references/lark-markdown-patch.md:71In the instructions
- `--content` 必须显式传入,但允许为空字符串- 未加 `--regex` 时,行为等价于对整份 Markdown 文本执行 `strings.ReplaceAll`- 加了 `--regex` 时,行为等价于对整份 Markdown 文本执行 RE2 全量替换;`--content` 里的 `$1`、`${name}` 会按 Go regexp replacement template 解释,字面 `$` 请写成 `$$`- 替换后的最终 Markdown 不能为空;如果 patch 结果是空字符串,CLI 会直接报错,不会上传空文件,因为 Drive 不支持零字节 Markdown,且空文件通常是误操作- `0` 命中时命令仍然成功返回,但不会上传新版本
references/lark-markdown-patch.md:96In the instructions
- 该命令的内部语义是:**download -> local replace -> overwrite upload**- 它不是服务端原子 patch;如果有人在你下载后、上传前更新了同一文件,本次 patch 仍可能覆盖那次中间修改- 它不会返回详细匹配位置,只返回命中数量- `--dry-run` 会同时展示两种可能的上传路径:`upload_all`(小文件)和 `upload_prepare/upload_part/upload_finish`(大文件分片上传)
Start here · InstructionsSKILL.md
lark-markdown
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 10
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records6 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/lark-markdown-create.mdFull text included
  • references/lark-markdown-diff.mdFull text included
  • references/lark-markdown-fetch.mdFull text included
  • references/lark-markdown-overwrite.mdFull text included
  • references/lark-markdown-patch.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-markdown-create.mdSupporting file
  • references/lark-markdown-diff.mdSupporting file
  • references/lark-markdown-fetch.mdSupporting file
  • references/lark-markdown-overwrite.mdSupporting file
  • references/lark-markdown-patch.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:47In the instructions
```bash# BAD: 未转义正则特殊字符,可能匹配到错误位置
references/lark-markdown-create.md:9In the instructions
```bash# 直接用行内内容创建
references/lark-markdown-diff.md:9In the instructions
```bash# 比较两个远端版本
Connect to websites
references/lark-markdown-create.md:37In the instructions
lark-cli markdown +create \  --folder-token "https://feishu.cn/drive/folder/fldcn_xxx" \  --file ./README.md
references/lark-markdown-create.md:47In the instructions
lark-cli markdown +create \  --wiki-token "https://feishu.cn/wiki/wikcn_xxx" \  --file ./README.md
Lines read
670
File checksum (to compare versions)
8c786ab2dd638141dfd01acdb37a10edbddcffb96d673164b18201df909b21c4