Skip to content
skillsafebeta
← Report library
Purpose / Other

Lark Shared Skill Security Audit

What the author says it does (original text)

Use for lark-cli setup/auth tasks: auth login/status/logout, user vs bot identity, business-domain permissions (--domain, including all/docs/drive), missing scopes, revoking authorization, or handling _notice JSON.

Independent security check

Security risks found

Files checked
7
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Low risk

The authorization link is exposed in command arguments, the reply, and a generated PNG file

Source references: 3
What we found

The Skill requires passing the verification URL as an argument to `lark-cli auth qrcode`, creating a relative-path PNG, and displaying both the original link and QR code to the user.

Why this matters

The authorization link appears in agent output and a workspace file, and may also be visible to local process-argument recording. If those locations are shared while the authorization flow remains valid, another person could obtain the same link.

The source does require placing the verification URL in a QR command argument, writing a PNG, and sending both the link and QR image into the conversation. If process arguments, chat logs, or the output file are readable by other local users, logging systems, or a shared workspace, temporary authentication information could leak. The source does not establish access controls or require PNG cleanup. Users can ask about link lifetime and cleanup, and restrict output to a private directory and private conversation.

SKILL.md:20In the instructions
3. **授权 / 配置类 URL 必须配二维码**：当命令输出 `verification_url`、`verification_uri_complete`、`console_url` 等 URL 字段时，必须用 `lark-cli auth qrcode` 生成并在回复中展示，URL 在前二维码在后；优先生成 PNG（`--output`），仅当用户明确要求时才使用 ASCII（`--ascii`）。URL 原样转发——不编解码、不加标点、不重拼 query，二维码和链接请一起展示给用户。
Show 2 other places
SKILL.md:35In the instructions
5. **文件路径只接受相对路径**：`--file`、`--output`、`--output-dir`、`@file` 等路径参数只接受 cwd 下的相对路径，传绝对路径会报 `unsafe file path`。数据输入（`@file`、大 JSON）优先用 stdin 传入，避免路径和转义问题。
references/lark-shared-identity-and-permissions.md:88In the instructions
1. 执行 `lark-cli auth login --scope "xxx" --no-wait --json`（必须加 `--no-wait --json`）2. 从 JSON 输出中提取 `verification_url` 和 `device_code`3. 生成二维码：`lark-cli auth qrcode <verification_url> --output "xxx"`4. 将 URL 和二维码展示给用户（先 URL，后二维码）5. **结束本轮对话前，必须明确告知用户**："请完成授权后，回来告诉我已授权完成，我会帮你完成后续步骤"
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

“All permissions” and additive authorization can leave the agent with broad, persistent user access

Source references: 5
What we found

The Skill offers `--domain all`, while user identity can access personal calendars, documents, email, and cloud storage. It also states that scopes accumulate across logins and that the CLI cannot revoke only one granted scope.

Why this matters

If the user selects all permissions or authorizes several scopes over time, later lark-cli operations may retain account access beyond the current task. Logging out locally does not revoke server-side authorization.

The source supports this risk, but it arises only if the user or agent selects `--domain all` or repeatedly adds scopes. User identity can access personal resources, login scopes accumulate, and the CLI cannot revoke one scope, so authorization may remain broader and longer-lived than the task requires. The user can require a specific minimal `--scope` and revoke unwanted server-side authorization in Lark's authorization management page.

references/lark-shared-identity-and-permissions.md:7In the instructions
|---|---|| 获取全部权限 | `lark-cli auth login --domain all --no-wait --json` || 按业务域授权 | `lark-cli auth login --domain docs --domain drive --no-wait --json`；`--domain` 可重复，也可用逗号分隔 || 指定单个 scope 授权 | `lark-cli auth login --scope "<scope>" --no-wait --json` || 检查当前登录态、是谁登录、token 是否有效 | `lark-cli auth status --json --verify`；回答时引用 `identity`、`verified`、`identities.user.status`、`identities.user.userName`、`identities.user.openId`（用户 open id）、`identities.user.tokenStatus`、`identities.user.scope` |
Show 4 other places
references/lark-shared-identity-and-permissions.md:14In the instructions
| bot 缺少权限 | 不要执行 `auth login`；引导用户在开发者后台开通 bot scope，优先复用错误里的 `console_url` || 取消用户对应用的全部服务端授权 | `auth logout` 只清本机登录态；服务端授权需用户在飞书授权管理页取消 || 只取消一个 scope | CLI 不支持单独撤销一个已授予 scope；可重新走最小 scope 授权，或让用户在授权管理页处理 |
references/lark-shared-identity-and-permissions.md:36In the instructions
- **Bot 看不到用户资源**：无法访问用户的日历、云空间（云盘/云存储）文档、邮箱等个人资源。例如 `--as bot` 查日程返回 bot 自己的（空）日历- **Bot 无法代表用户操作**：发消息以应用名义发送，创建文档归属 bot- **Bot 权限**：只需在飞书开发者后台开通 scope，无需 `auth login`- **User 权限**：后台开通 scope + 用户通过 `auth login` 授权，两层都要满足
references/lark-shared-identity-and-permissions.md:65In the instructions
**规则**：auth login 必须指定范围（`--scope`、`--domain` 或 `--recommend`）。多次 login 的 scope 会累积（增量授权）。
references/lark-shared-identity-and-permissions.md:29In the instructions
|------|------|---------|---------|| user 用户身份 | `--as user` | `lark-cli auth login` 等 | 访问用户自己的资源（日历、云空间/云盘/云存储等） || bot 应用身份 | `--as bot` | 自动，只需 appId + appSecret | 应用级操作,访问bot自己的资源 |
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

3 instruction sections

This Skill is a rule set for lark-cli authentication, identity, permissions, and output handling. It requires distinguishing user from bot before acting because user identity can access personal resources such as calendars and cloud storage, while bot identity is limited to the application's resources.

View source
SKILL.md:18In the instructions
2. **身份决定你代表谁操作**：`--as user` 代表用户本人（能看到、也能操作其日历、云空间/云盘/云存储等个人资源），`--as bot` 代表应用自己，应用级操作，只能访问bot自己的资源，bot 查用户资源会返回空成功而非报错。动手前先搞清楚身份`identity`。身份模型和权限管理 → [`lark-shared-identity-and-permissions.md`](references/lark-shared-identity-and-permissions.md)。
references/lark-shared-identity-and-permissions.md:36In the instructions
- **Bot 看不到用户资源**：无法访问用户的日历、云空间（云盘/云存储）文档、邮箱等个人资源。例如 `--as bot` 查日程返回 bot 自己的（空）日历- **Bot 无法代表用户操作**：发消息以应用名义发送，创建文档归属 bot- **Bot 权限**：只需在飞书开发者后台开通 scope，无需 `auth login`- **User 权限**：后台开通 scope + 用户通过 `auth login` 授权，两层都要满足

Writes and deletions require confirmation of the user's intent. For the CLI's high-risk gate, the action, risk, and key parameters must be shown again, and the confirmation flag may be added only after explicit user approval.

View source
SKILL.md:29In the instructions
2. **写入/删除操作前必须确认用户意图**。3. 目标命令支持 `--dry-run` 时，用 `--dry-run` 预览危险请求。4. **退出码 10 是高风险确认门禁（`risk: "high-risk-write"`），不是错误**：停下 → **向用户确认**（展示 `action`、`risk` 和关键参数）→ 取得**用户显式同意**后，将 `hint` 指出的确认 flag **追加到你原始 argv 的末尾**后重试；**绝不**静默加确认 flag 绕过 → [`lark-shared-high-risk-approval.md`](references/lark-shared-high-risk-approval.md)。
references/lark-shared-high-risk-approval.md:22In the instructions
1. **识别**：看到子进程 exit code = `10` 且 stderr JSON 里 `error.type == "confirmation"`、`error.subtype == "confirmation_required"`2. **向用户确认**：把 `error.action`、`error.risk` 和关键参数展示给用户，明确告知"这是高风险操作"，等待用户显式同意3. **用户同意** → 按 `error.hint` 确定确认 flag，并追加到你**自己的原始 argv** 后重试。多数命令使用 `--yes`4. **用户拒绝** → 终止流程，不要擅自改写参数或跳过门禁

Authentication uses a split flow: first generate and present the verification link and QR code, then return control. Only after the user confirms authorization does the agent use the corresponding device code to complete login.

View source
references/lark-shared-identity-and-permissions.md:88In the instructions
1. 执行 `lark-cli auth login --scope "xxx" --no-wait --json`（必须加 `--no-wait --json`）2. 从 JSON 输出中提取 `verification_url` 和 `device_code`3. 生成二维码：`lark-cli auth qrcode <verification_url> --output "xxx"`4. 将 URL 和二维码展示给用户（先 URL，后二维码）5. **结束本轮对话前，必须明确告知用户**："请完成授权后，回来告诉我已授权完成，我会帮你完成后续步骤"**第二步：完成授权（后续轮）**1. 等待用户回复"已完成授权"2. **由你（AI agent）亲自执行**：`lark-cli auth login --device-code <device_code>`3. 此命令会轮询授权状态并完成登录4. 如果返回授权成功，流程结束
Start here · InstructionsSKILL.md
lark-shared
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 5
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records7 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/lark-shared-config-init.mdFull text included
  • references/lark-shared-high-risk-approval.mdFull text included
  • references/lark-shared-identity-and-permissions.mdFull text included
  • references/lark-shared-output-contract.mdFull text included
  • references/lark-shared-update-notice.mdFull text included
  • references/lark-wiki-token-routing.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-shared-config-init.mdSupporting file
  • references/lark-shared-high-risk-approval.mdSupporting file
  • references/lark-shared-identity-and-permissions.mdSupporting file
  • references/lark-shared-output-contract.mdSupporting file
  • references/lark-shared-update-notice.mdSupporting file
  • references/lark-wiki-token-routing.mdSupporting file

Operations mentioned in code and instructions

Run commands
references/lark-shared-config-init.md:9In the instructions
```bash# 发起配置（该命令会阻塞直到用户打开链接并完成操作或过期）
references/lark-shared-identity-and-permissions.md:19In the instructions
```bashLARKSUITE_CLI_NO_UPDATE_NOTIFIER=1 LARKSUITE_CLI_NO_SKILLS_NOTIFIER=1 lark-cli auth status --json --verify
references/lark-shared-identity-and-permissions.md:60In the instructions
```bashlark-cli auth login --domain <domain> --no-wait --json          # 按业务域发起授权
Connect to websites
references/lark-wiki-token-routing.md:10In the instructions
```bashlark-cli drive +inspect --url 'https://xxx.feishu.cn/wiki/<wiki_token>'```
Lines read
292
File checksum (to compare versions)
26e9f1f38340a94637f2d54f24b1bac806ce285426be9342df12e1a37d53db43