lark-workflow-standup-report
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
lark-cli calendar +agendaandlark-cli task +get-my-taskscommands to retrieve user data. These are targeted commands for a specific service (Lark/Feishu) and are within the documented scope of the skill's purpose. - [DATA_EXPOSURE]: While the skill accesses sensitive calendar and task data, it does so to present it back to the user within the AI's response. There are no patterns suggesting the data is being sent to third-party endpoints or non-whitelisted domains.
- [PRIVILEGE_ESCALATION]: The skill explicitly mentions it only supports 'user' identity and requires the user to have already authenticated via
lark-cli auth login, following a least-privilege approach. - [SAFE]: The repository source provided (
github:larksuite/cli) belongs to a well-known organization (Larksuite/ByteDance). The dependencies on internal shared skills (../lark-shared/SKILL.md) illustrate a modular and standard architectural pattern for this vendor's ecosystem.
Audit Metadata