lark-push
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
lark-clito transmit messages andpython3to generate interactive card payloads. It also provides an optional Git hook script that monitors local commits to automate notifications. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing the official
@larksuite/clifrom the npm registry and Python 3 via standard system package managers. - [DATA_EXFILTRATION]: The skill's primary function is to collect project metadata—such as Git commit hashes, branch names, and author information—and transmit it along with user-provided report content to a configured Feishu/Lark chat group.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Git logs, standard input, and local files. It mitigates injection risks by using Bash arrays for command construction and JSON serialization for card payloads, ensuring that external data is treated as content rather than executable instructions.
Audit Metadata