lark-apps
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill extensively utilizes the
lark-clibinary to perform platform operations, including application creation, database migration via+db-execute, file management, and Git credential initialization. These commands are executed within the user's authenticated context with explicit confirmation prompts for high-risk operations. - [DYNAMIC_EXECUTION]: The creative design workflow uses
@babel/standaloneto transpile JSX in the browser at runtime for rapid prototyping. Additionally, it defines afork-verifier-agentthat uses JavaScript evaluation (eval_js) to inspect the DOM and logs of generated HTML files for debugging purposes, though it is strictly constrained to a read-only role. - [EXTERNAL_DOWNLOADS]: Fetches core web dependencies including React, ReactDOM, Babel, and ECharts from the official ByteDance static CDN (
sf3-scmcdn-cn.feishucdn.com). It also loads fonts from a self-hosted mirror onmiaoda.feishu.cnto ensure reliable delivery in all regions.
Audit Metadata