lark-coding-agent-bridge
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
lark-channel-bridgepackage globally from the NPM registry. This package is an external executable from a non-trusted source (the skill author). - [COMMAND_EXECUTION]: The skill manages background services across multiple operating systems (macOS launchd, Linux systemd, Windows Task Scheduler) and provides commands for process management (
ps,kill,exit), granting the agent control over local service execution. - [DATA_EXFILTRATION]: The skill documentation describes a command to export profile configurations including decrypted secrets (
lark-channel-bridge profile export --include-secrets), which presents a risk of credential exposure if invoked by the agent or directed to an external output. - [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The core function of the skill is to bridge external input from a messenger platform to a local agent with high capabilities.
- Ingestion points: Incoming messages, mentions, and file attachments from Feishu/Lark messenger forwarded to the local coding agent (SKILL.md).
- Boundary markers: The instructions do not specify any delimiters or safety prompts to prevent the local agent from obeying instructions embedded in the messenger traffic.
- Capability inventory: The connected agents (Claude Code, Codex CLI) possess extensive capabilities including terminal command execution and file system modification.
- Sanitization: There is no evidence of sanitization or filtering of incoming data before it is processed by the local agent.
Audit Metadata