ClawHub
Back to skill

Security audit

Lark

Security checks for vulnerabilities and agentic risk

Overview

This Lark skill is a disclosed, instruction-only collaboration assistant, but users should grant Lark credentials carefully because it can read broad workplace data and may perform authorized routine actions in Executive Mode.

Install only if you intend to let the host Lark connector access workplace collaboration data. Use least-privilege Lark app credentials, keep Counselor Mode as the default for review-heavy workflows, and require explicit confirmation before sends, approval decisions, spreadsheet edits, or calendar changes.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.json (reported line 24)May include surrounding context.

json
"coordination_diagnosis": "Diagnose collaboration friction before selecting an action path",
    "tactical_orchestration": "Choose the best operational layer and action type under real constraints",
    "handshake_protocol": "Enforce mode selection for operational safety",
    "red_line_protection": "Suppress high-friction or high-sensitivity actions without confirmation",
    "context_recovery": "Recover the real decision context across chats, meetings, docs, and sheets"
  },
  "triggers": [

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list contains broad phrases such as 'meeting summary' and 'review pending approvals' that can easily overlap with ordinary user requests. In a skill that can orchestrate actions across chat, approvals, meetings, docs, and spreadsheets, ambiguous activation increases the chance of unintended invocation and downstream access or action in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest declares required Lark credentials via environment variables but provides no user-facing notice about external service connectivity, credential use, or what data the skill may access. This reduces informed consent and can lead users or operators to enable a skill that accesses enterprise collaboration data without understanding its scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skill.md (reported line 101)May include surrounding context.

md
- **Context Gap:** do not act if the thread history or background is incomplete
- **Premature Nudge:** avoid public reminders before validating urgency and stakeholder sensitivity
- **Blind Edit:** never update master operational records without checking the latest collaboration context
- **Wrong Layer Action:** do not solve a document-memory problem with a chat response if retrieval is the real issue
- **Escalation Drift:** do not escalate what is actually a routine follow-up problem

Static analysis

No suspicious patterns detected.