lark-openapi-explorer

Pass

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses lark-cli to interact with the Lark/Feishu API. This is the intended primary purpose of the skill and relies on a pre-installed binary specified in the metadata.
  • [EXTERNAL_DOWNLOADS]: The skill instructions involve fetching documentation from official domains (open.feishu.cn and open.larksuite.com). These are well-known, official service domains for the Lark platform and are considered safe.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation content via WebFetch. While this represents a data ingestion surface, the risk is mitigated by the highly structured nature of the tasks (extracting API specifications) and the requirement for explicit user confirmation for write/delete operations. The impact is assessed as safe given the context of official documentation.
  • [PRIVILEGE_ESCALATION]: The skill does not request or utilize elevated privileges (e.g., sudo). Operations are performed within the context of the user's lark-cli configuration and authentication.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 8, 2026, 06:56 AM
Security Audit — agent-trust-hub — lark-openapi-explorer