lark-openapi-explorer
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests markdown documentation from external domains to determine API paths and parameters.
- Ingestion points: Fetches content from open.feishu.cn and open.larksuite.com (SKILL.md).
- Boundary markers: None specified for the document parsing process.
- Capability inventory: Executes shell commands via lark-cli, including GET, POST, PUT, and DELETE operations.
- Sanitization: Requires user confirmation for write/delete actions and recommends the use of --dry-run flags.
- [COMMAND_EXECUTION]: The skill dynamically constructs and executes shell commands using the lark-cli tool based on information extracted from external documents.
- [EXTERNAL_DOWNLOADS]: Retrieves API documentation and module indices from official Feishu and Lark developer portals.
Audit Metadata