lark-openapi-explorer
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
lark-clito interact with the Lark/Feishu API. This is the intended primary purpose of the skill and relies on a pre-installed binary specified in the metadata. - [EXTERNAL_DOWNLOADS]: The skill instructions involve fetching documentation from official domains (
open.feishu.cnandopen.larksuite.com). These are well-known, official service domains for the Lark platform and are considered safe. - [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation content via
WebFetch. While this represents a data ingestion surface, the risk is mitigated by the highly structured nature of the tasks (extracting API specifications) and the requirement for explicit user confirmation for write/delete operations. The impact is assessed as safe given the context of official documentation. - [PRIVILEGE_ESCALATION]: The skill does not request or utilize elevated privileges (e.g., sudo). Operations are performed within the context of the user's
lark-cliconfiguration and authentication.
Audit Metadata