Skip to content
skillsafebeta
← Report library
Purpose / Data analysis

Lark Task Skill Security Audit

What the author says it does (original text)

飞书任务：管理任务、清单和任务智能体。创建待办任务、查看和更新任务状态、拆分子任务、组织任务清单、分配协作成员、上传任务附件、注册或注销任务智能体、更新任务智能体的主页数据、写入智能体任务记录。当用户需要创建待办事项、查看任务列表、跟踪任务进度、管理项目清单或给他人分配任务、为任务上传附件文件、注册注销任务智能体、更新智能体主页数据、写入任务记录时使用。

Independent security check

Security risks found

Files checked
18
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Attachment upload sends local file contents to Lark

Source references: 4
What we found

The command reads a relative-path file from the working directory and uploads it to a task or task agent. Path restrictions prevent directory escape but do not determine whether the file contains credentials, customer data, or other sensitive material.

Why this matters

If the wrong file, task GUID, or task agent is selected, people with access to that Lark resource may see the file contents.

This feature reads one local file from the current working directory and uploads it to a Lark task or task agent. Relative-path, directory, and 50 MB restrictions reduce arbitrary-file access, and the workflow requires confirming the target and path; however, it does not require checking the file for credentials or sensitive data. If the wrong file is selected, its contents leave the device and may become visible to task participants. The user can require a pre-upload display of the filename, destination, and sensitivity check.

references/lark-task-upload-attachment.md:38In the instructions
|-----------|----------|-------------|| `--resource-id <guid_or_applink>` | Yes | Target resource GUID. Accepts a raw task GUID or a Feishu task applink URL (`.../client/todo/task?guid=...`); the `guid` query parameter is extracted automatically. Do not use `suite_entity_num` / display IDs like `t104121`. || `--file <path>` | Yes | Local file path to upload. Must be a relative path within the current working directory; absolute paths and paths escaping the cwd are rejected. Single file only, ≤ 50 MB. || `--resource-type <type>` | No | Owning resource type. Defaults to `task`. Use `task_delivery` when uploading to task agents. || `--user-id-type <type>` | No | User ID type for the request. Defaults to `open_id`. |
Show 3 other places
references/lark-task-upload-attachment.md:45In the instructions
1. Confirm the target task GUID (or applink) and the local file path with the user.2. Ensure the file is within the current working directory and its size is ≤ 50 MB; otherwise ask the user to move/split the file.3. Determine if this is a task agent: if yes, add `--resource-type task_delivery`.4. Execute `lark-cli task +upload-attachment --resource-id "..." --file "..."`.5. Report the returned attachment record. The output exposes all fields returned by the API (e.g. `guid`, `name`, `size`, `url`, `uploader`, ...); always surface the attachment `guid` and, if present, the `url` so the user can jump to the attachment directly.
references/lark-task-upload-attachment.md:5In the instructions
Upload a single local file as an attachment to a task (or any resource type accepted by the Task attachment endpoint). Max file size per upload is **50 MB**. For task agents, use `--resource-type=task_delivery`.
references/lark-task-upload-attachment.md:39In the instructions
| `--resource-id <guid_or_applink>` | Yes | Target resource GUID. Accepts a raw task GUID or a Feishu task applink URL (`.../client/todo/task?guid=...`); the `guid` query parameter is extracted automatically. Do not use `suite_entity_num` / display IDs like `t104121`. || `--file <path>` | Yes | Local file path to upload. Must be a relative path within the current working directory; absolute paths and paths escaping the cwd are rejected. Single file only, ≤ 50 MB. || `--resource-type <type>` | No | Owning resource type. Defaults to `task`. Use `task_delivery` when uploading to task agents. || `--user-id-type <type>` | No | User ID type for the request. Defaults to `open_id`. |
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Medium risk

Exact tasklist member setting replaces every existing member

Source references: 4
What we found

The --set option is not additive; it replaces the entire member set with the supplied IDs. Although confirmation is required, a user may interpret “set these members” as “add these members” and unintentionally omit existing people.

Why this matters

Existing members may lose tasklist access or editing rights, interrupting collaboration and task visibility.

`--set` explicitly replaces the entire existing member set with the supplied IDs rather than adding incrementally, so omitted members may lose task-list access or editing rights. The examples and parameter table distinguish `--add` from `--set`, and confirmation is required; the risk arises if the user misunderstands “set” or the confirmation omits existing members. The user can require a before-and-after member diff prior to execution.

references/lark-task-tasklist-members.md:24In the instructions
|-----------|----------|-------------|| `--tasklist-id <id>` | Yes | The GUID of the tasklist, or a full AppLink URL. || `--add <ids>` | No | Comma-separated list of user `open_id`s to add as members. || `--remove <ids>` | No | Comma-separated list of user `open_id`s to remove from members. || `--set <ids>` | No | Comma-separated list of user `open_id`s to exactly set as members (replaces all existing). |
Show 3 other places
references/lark-task-tasklist-members.md:31In the instructions
1. Confirm the tasklist and members to add/remove/set.2. Execute the command.3. Report success.> [!CAUTION]> This is a **Write Operation** -- You must confirm the user's intent before executing.
references/lark-task-tasklist-members.md:10In the instructions
```bash# Add a memberlark-cli task +tasklist-members --tasklist-id "tl_xxx" --add "ou_aaa"# Remove a memberlark-cli task +tasklist-members --tasklist-id "tl_xxx" --remove "ou_aaa"# Replace all members exactlylark-cli task +tasklist-members --tasklist-id "tl_xxx" --set "ou_aaa,ou_bbb"```
references/lark-task-tasklist-members.md:27In the instructions
| `--remove <ids>` | No | Comma-separated list of user `open_id`s to remove from members. || `--set <ids>` | No | Comma-separated list of user `open_id`s to exactly set as members (replaces all existing). |
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

A generic “help me create a task” is forcibly interpreted as assignment to the current user

Source references: 3
What we found

The creation workflow requires the agent to retrieve the logged-in user's open_id and assign the task to that user even when the request only says “help me create a task.” This adds an assignee decision the user did not necessarily state.

Why this matters

The task may incorrectly appear in the current user's assigned work, affecting reminders, reporting, or responsibility—especially during delegated operation or use of a shared account.

The workflow treats “help me create a task” as requiring assignment to the currently logged-in user even when no assignee was explicitly named. It retrieves that account's open_id and passes it as `--assignee`, potentially creating an unintended responsibility or notification. Although the workflow requires confirming the assignee and the write operation, this default is still an active instruction. The user can require confirmation to state “assigned to the current account,” or request that unspecified tasks remain unassigned.

references/lark-task-create.md:57In the instructions
1. Confirm with the user: task summary, due date, assignee, and tasklist if necessary.   - **Crucial Rule for Assignee**: If the user explicitly or implicitly says "create a task for me" (给我创建一个任务), or "help me create a task" (帮我新建/创建一个任务), you MUST assign the task to the current logged-in user. You can get the current user's `open_id` by executing `lark-cli auth status` (it already outputs JSON by default, so do not add `--json`) or `lark-cli contact +get-user` first, extracting `.identities.user.openId` (from `auth status`) or `.data.user.open_id` (from `contact +get-user`), and then passing it to the `--assignee` parameter.2. Execute `lark-cli task +create --summary "..." ...`3. Judge success by `ok == true` in the stdout JSON (the success envelope has no `code` field — do not test `code == 0`), then report the result: task ID (`data.guid`) and summary.
Show 2 other places
references/lark-task-create.md:43In the instructions
| `--description <text>` | No | Detailed description of the task || `--assignee <id>` | No | Assignee ID. Use user `open_id` like `ou_xxx` for people, or app ID like `cli_xxx` for apps. || `--follower <id>` | No | Follower ID. Use user `open_id` like `ou_xxx` for people, or app ID like `cli_xxx` for apps. |
references/lark-task-create.md:75In the instructions
> [!CAUTION]> This is a **Write Operation** -- You must confirm the user's intent before executing.

Inside this skill

3 instruction sections

This Skill uses lark-cli to read, create, and modify Lark tasks, tasklists, members, reminders, attachments, and task-agent data; the write interfaces require Lark task write permissions.

View source
SKILL.md:91In the instructions
  - `create` — 创建任务  - `delete` — 删除任务  - `get` — 获取任务详情  - `list` — 列取任务列表  - `patch` — 更新任务
SKILL.md:154In the instructions
|------|-----------|| `tasks.create` | `task:task:write` || `tasks.delete` | `task:task:write` || `tasks.get` | `task:task:read` || `tasks.list` | `task:task:read` || `tasks.patch` | `task:task:write` || `tasklists.add_members` | `task:tasklist:write` |

The supplied shortcut documentation generally requires confirmation of user intent before write operations such as creation, updates, completion, and member assignment, reducing accidental changes.

View source
references/lark-task-create.md:75In the instructions
> [!CAUTION]> This is a **Write Operation** -- You must confirm the user's intent before executing.
references/lark-task-update.md:40In the instructions
> [!CAUTION]> This is a **Write Operation** -- You must confirm the user's intent before executing.
references/lark-task-assign.md:37In the instructions
> [!CAUTION]> This is a **Write Operation** -- You must confirm the user's intent before executing.

The attachment feature uploads one relative-path file of up to 50 MB from the current working directory to a specified Lark task or task agent, and requires confirmation of the target and path.

View source
references/lark-task-upload-attachment.md:38In the instructions
|-----------|----------|-------------|| `--resource-id <guid_or_applink>` | Yes | Target resource GUID. Accepts a raw task GUID or a Feishu task applink URL (`.../client/todo/task?guid=...`); the `guid` query parameter is extracted automatically. Do not use `suite_entity_num` / display IDs like `t104121`. || `--file <path>` | Yes | Local file path to upload. Must be a relative path within the current working directory; absolute paths and paths escaping the cwd are rejected. Single file only, ≤ 50 MB. || `--resource-type <type>` | No | Owning resource type. Defaults to `task`. Use `task_delivery` when uploading to task agents. || `--user-id-type <type>` | No | User ID type for the request. Defaults to `open_id`. |
references/lark-task-upload-attachment.md:45In the instructions
1. Confirm the target task GUID (or applink) and the local file path with the user.2. Ensure the file is within the current working directory and its size is ≤ 50 MB; otherwise ask the user to move/split the file.3. Determine if this is a task agent: if yes, add `--resource-type task_delivery`.4. Execute `lark-cli task +upload-attachment --resource-id "..." --file "..."`.5. Report the returned attachment record. The output exposes all fields returned by the API (e.g. `guid`, `name`, `size`, `url`, `uploader`, ...); always surface the attachment `guid` and, if present, the `url` so the user can jump to the attachment directly.

This Skill delegates authentication, permission handling, and security rules to a neighboring lark-shared Skill that is not included in the supplied evidence, so those rules cannot be verified from this source.

View source
SKILL.md:13In the instructions
**CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理**
references/lark-task-create.md:3In the instructions
> **Prerequisites:** Please read `../lark-shared/SKILL.md` to understand authentication, global parameters, and security rules.
Start here · InstructionsSKILL.md
lark-task
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 18
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records18 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/lark-task-assign.mdFull text included
  • references/lark-task-comment.mdFull text included
  • references/lark-task-complete.mdFull text included
  • references/lark-task-create.mdFull text included
  • references/lark-task-followers.mdFull text included
  • references/lark-task-get-my-tasks.mdFull text included
  • references/lark-task-get-related-tasks.mdFull text included
  • references/lark-task-reminder.mdFull text included
  • references/lark-task-reopen.mdFull text included
  • references/lark-task-search.mdFull text included
  • references/lark-task-set-ancestor.mdFull text included
  • references/lark-task-tasklist-create.mdFull text included
  • references/lark-task-tasklist-members.mdFull text included
  • references/lark-task-tasklist-search.mdFull text included
  • references/lark-task-tasklist-task-add.mdFull text included
  • references/lark-task-update.mdFull text included
  • references/lark-task-upload-attachment.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/lark-task-assign.mdSupporting file
  • references/lark-task-comment.mdSupporting file
  • references/lark-task-complete.mdSupporting file
  • references/lark-task-create.mdSupporting file
  • references/lark-task-followers.mdSupporting file
  • references/lark-task-get-my-tasks.mdSupporting file
  • references/lark-task-get-related-tasks.mdSupporting file
  • references/lark-task-reminder.mdSupporting file
  • references/lark-task-reopen.mdSupporting file
  • references/lark-task-search.mdSupporting file
  • references/lark-task-set-ancestor.mdSupporting file
  • references/lark-task-tasklist-create.mdSupporting file
  • references/lark-task-tasklist-members.mdSupporting file
  • references/lark-task-tasklist-search.mdSupporting file
  • references/lark-task-tasklist-task-add.mdSupporting file
  • references/lark-task-update.mdSupporting file
  • references/lark-task-upload-attachment.mdSupporting file

Operations mentioned in code and instructions

Run commands
SKILL.md:17In the instructions
执行任何 Task 命令前，必须先确认能力真实存在，禁止根据用户意图自行拼接或猜测 `+<verb>`：
SKILL.md:82In the instructions
```bashlark-cli schema task.<resource>.<method>   # 调用 API 前必须先查看参数结构
references/lark-task-assign.md:9In the instructions
```bash# Add an assignee
Connect to websites
references/lark-task-complete.md:14In the instructions
# A task applink is accepted directly; the CLI extracts its guid query valuelark-cli task +complete --task-id "https://applink.larksuite.com/client/todo/task?guid=<task_guid>"```
references/lark-task-create.md:16In the instructions
  --due "2026-03-25" \  --tasklist-id "https://applink.larkoffice.com/client/todo/task_list?guid=a4b00000-000-000-000-00000000036c"
references/lark-task-create.md:70In the instructions
    "guid": "e297d3d0-4b60-4a5f-a4d4-xxxxxxxxxxxx",    "url": "https://applink.larkoffice.com/client/todo/detail?guid=e297d3d0-4b60-4a5f-a4d4-xxxxxxxxxxxx"  }
Lines read
915
File checksum (to compare versions)
79a5754d3e35f298c13645205eb0f87ababb4524f674d70de63fb048130cc4ad