Lark Okr Skill Security Audit

Progress and alignment deletion are explicitly irreversible, yet their execution examples and workflows require neither user confirmation nor a confirmation flag. Comment deletion, by contrast, requires a dry run, an irreversibility warning, user confirmation, and --yes. If an agent directly acts on a general deletion request, a progress record or alignment could be permanently lost. Users can require the same explicit confirmation gate used for comment deletion.

The main document allows bot identity to view another person's OKRs, whose app-level access may differ from the current user's access. However, it requires corresponding permission and mandates reading shared authentication and permission rules that were not provided. The evidence therefore cannot show whether requester authorization is checked. A user can ask how bot mode verifies that the requester may view the target's OKRs and restrict operations to user identity by default.

The instruction lets the agent choose a semantically suitable category merely on suspicion that the tenant requires one, explicitly without waiting for confirmation. Categories can convey business meanings such as personal, team, or committed OKRs, so a wrong choice may alter how a goal is interpreted or displayed. Users can require the skill to show candidate category names and obtain confirmation before writing, or restrict it to user-specified categories.

When the user omits source fields, progress creation defaults to “created by lark-cli” and a Feishu/Lark official app URL, while the documentation says these fields are displayed as the progress source. This is not credential or data exfiltration, but it may misleadingly present an official app page as the information source and expose tool usage. Users can ask that source fields remain empty by default or be shown for confirmation before writing.