lark-skill-maker
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a template and meta-instruction set for building other skills. It does not contain executable malicious payloads or dangerous commands.
- [COMMAND_EXECUTION]: The shell commands provided (e.g.,
lark-cli api,lark-cli schema) are legitimate usage patterns for the documentedlark-clitool, which is a required binary for the skill's functionality. The skill explicitly instructs the agent to confirm user intent before performing write operations. - [EXTERNAL_DOWNLOADS]: The skill references official documentation and repositories from the Larksuite organization. These references are used for information gathering and context, following standard development practices.
- [INDIRECT_PROMPT_INJECTION]: While the skill involves processing external API data, it includes explicit guardrails in the 'Usage Notes' and 'Boundaries' sections, instructing the agent to verify tasks, ask for clarification before destructive actions, and maintain user authority over instructions.
Audit Metadata