lark-cli

SUSPICIOUS: The skill's purpose and capabilities mostly align, and it uses the official npm package for the stated Lark CLI setup workflow. However, it relies on a mutable @latest install, a downloaded native binary, and a transitive installation of additional Lark AI skills, which meaningfully increase trust and supply-chain risk even without evidence of explicit exfiltration or malicious intent.