lark-doc

SUSPICIOUS: the skill’s behavior is mostly coherent with its stated purpose, but it requires sending business materials and an API key to an external AI Skills service, with limited verification of the runner/tooling path and no direct visibility into the referenced script. This looks more like a third-party SaaS integration trust risk than confirmed malware.