Skip to content
skillsafebeta
← Report library
Purpose / Other

Lark Skill Maker Skill Security Audit

What the author says it does (original text)

创建 lark-cli 的自定义 Skill。当用户需要把飞书 API 操作封装成可复用的 Skill（包装原子 API 或编排多步流程）时使用。

Independent security check

Security risks found

Files checked
1
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The generic OpenAPI escape hatch can run Feishu operations not constrained by the template

Source references: 4
What we found

The Skill explicitly exposes arbitrary OpenAPI methods and paths and places a POST command in generated skills. Write confirmation and dry-run are only stated as principles, with dry-run merely recommended and no enforcement shown.

Why this matters

When the AI uses a logged-in identity with matching scopes, a generated skill could read or modify Feishu resources beyond what the user expected from the immediate request. The exact impact depends on the endpoint, parameters, and permissions ultimately inserted.

Legitimate use of this code

The source does expose a generic Feishu OpenAPI form and a POST template, but these are instructions for authoring a user-requested Skill, not directions to execute the examples immediately. It also explicitly requires confirmation before writes and recommends dry-run. A generated Skill could modify Feishu data when authorized, but describing it as unconstrained omits the stated purpose and confirmation rule. Users should still verify its exact endpoints, scopes, and confirmation flow before use.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:16In the instructions
```bashlark-cli <service> <resource> <method>          # 已注册 APIlark-cli <service> +<verb>                      # Shortcut（高级封装）lark-cli api <METHOD> <path> [--data/--params]  # 任意飞书 OpenAPIlark-cli schema <service.resource.method>       # 查参数定义```优先级：Shortcut > 已注册 API > `api` 裸调。
Show 3 other places
SKILL.md:62In the instructions
## 命令\```bash# 单步操作lark-cli api POST /open-apis/xxx --data '{...}'# 多步编排：说明步骤间数据传递# Step 1: ...（记录返回的 xxx_id）# Step 2: 使用 Step 1 的 xxx_id\```
SKILL.md:82In the instructions
- **description 决定触发** — 包含功能关键词 + "当用户需要...时使用"- **认证** — 说明所需 scope，登录用 `lark-cli auth login --domain <name>`- **安全** — 写入操作前确认用户意图，建议 `--dry-run` 预览- **编排** — 说明数据传递、失败回滚、可并行步骤
SKILL.md:80In the instructions
## 关键原则- **description 决定触发** — 包含功能关键词 + "当用户需要...时使用"- **认证** — 说明所需 scope，登录用 `lark-cli auth login --domain <name>`- **安全** — 写入操作前确认用户意图，建议 `--dry-run` 预览- **编排** — 说明数据传递、失败回滚、可并行步骤
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

The workflow inherits instructions from two adjacent skills that were not provided

Source references: 2
What we found

This Skill requires lark-openapi-explorer when API coverage is insufficient, while its generated template requires reading lark-shared first. Neither referenced file is included in the supplied source, so any additional commands, permissions, or behavior cannot be reviewed.

Why this matters

If either adjacent file is unsafe, altered, or overly broad, the AI could perform additional actions during research or while running a generated skill. The evidence does not show that those files are malicious or safe.

What this evidence establishes

These are active cross-file instructions: lark-openapi-explorer is required when CLI coverage is insufficient, and generated Skills are told to read lark-shared first. The source says the former discovers methods, parameters, and permissions, but neither referenced file is provided. It is therefore impossible to determine whether they add privileged, write, or otherwise risky behavior, or to conclude that dangerous instructions will be inherited. Users can request both dependencies for review or restrict their use until reviewed.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:39In the instructions
如果以上命令无法覆盖需求（CLI 没有对应的已注册 API 或 Shortcut），使用 [lark-openapi-explorer](../lark-openapi-explorer/SKILL.md) 从飞书官方文档库逐层挖掘原生 OpenAPI 接口，获取完整的方法、路径、参数和权限信息，再通过 `lark-cli api` 裸调完成任务。通过以上流程确定需要哪些 API、参数和 scope。
Show 1 other places
SKILL.md:58In the instructions
# <标题>> **前置条件：** 先阅读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)。
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

4 instruction sections

This Skill guides an AI to create new Feishu CLI skills. Its output is a SKILL.md placed under a specified skills directory, rather than a standalone program.

View source
SKILL.md:10In the instructions
# Skill Maker基于 lark-cli 创建新 Skill。Skill = 一份 `SKILL.md`，教 AI 用 CLI 命令完成任务。
SKILL.md:43In the instructions
## SKILL.md 模板文件放在 `skills/lark-<name>/SKILL.md`：

It prefers shortcuts and registered APIs, but permits generic `lark-cli api` calls to arbitrary Feishu OpenAPI paths when those options are insufficient.

View source
SKILL.md:16In the instructions
```bashlark-cli <service> <resource> <method>          # 已注册 APIlark-cli <service> +<verb>                      # Shortcut（高级封装）lark-cli api <METHOD> <path> [--data/--params]  # 任意飞书 OpenAPIlark-cli schema <service.resource.method>       # 查参数定义```优先级：Shortcut > 已注册 API > `api` 裸调。

The template calls for documenting required scopes, confirming intent before writes, previewing with dry-run, and explaining rollback. These are guidance statements; the provided text shows no enforcement mechanism.

View source
SKILL.md:73In the instructions
## 权限| 操作 | 所需 scope ||------|-----------|| xxx | `scope:name` |```
SKILL.md:82In the instructions
- **description 决定触发** — 包含功能关键词 + "当用户需要...时使用"- **认证** — 说明所需 scope，登录用 `lark-cli auth login --domain <name>`- **安全** — 写入操作前确认用户意图，建议 `--dry-run` 预览- **编排** — 说明数据传递、失败回滚、可并行步骤
Start here · InstructionsSKILL.md
lark-skill-maker
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:16In the instructions
```bashlark-cli <service> <resource> <method>          # 已注册 API
SKILL.md:27In the instructions
```bash# 1. 查看已有的 API 资源和 Shortcut
SKILL.md:64In the instructions
\```bash# 单步操作
Lines read
86
File checksum (to compare versions)
1853be810762bc606658b7b1e35c16d20b439eeca0f85773a58c596a40f491b9