lark-coding-agent-bridge

SUSPICIOUS. The core behavior is coherent for a Lark-to-local-agent bridge, but the install provenance is not clearly aligned with the stated ara.so publisher, creating meaningful supply-chain trust concerns. Aside from that mismatch, the documented credentials, file access, and network flows are mostly proportionate to the stated purpose and do not show clear malicious exfiltration.