Work2cli Hitl with larkcli

• Outcome: Review
• Latest audit: Sep 22, 2026 · 4:11 AM UTC
• Version: 0.1.1

Overview

The skill is a coherent CLI/HITL automation framework, but it normalizes broad browser-session credential reuse, request replay, and persistent background approval infrastructure for arbitrary systems without enough scoping or consent controls.

Review before installing. This skill is not just a HITL guard template; it teaches agents to inspect live web apps, reuse browser/session credentials, parse local token sources, replay request headers, create persistent local CLIs, and run a long-lived Feishu approval daemon. Only use it in environments where those behaviors are explicitly authorized, and require agents to use scoped credentials or documented APIs instead of copying browser cookies, tokens, or full headers.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (31)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells the agent to reuse existing login state and automatically obtain tokens/cookies from browser sessions without a strong consent, minimization, or handling policy. This is dangerous because session tokens are highly sensitive credentials; harvesting them during autonomous reconnaissance can expose accounts, enable lateral movement, and normalize silent credential extraction from unrelated systems.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatically extracting cookies or tokens from browser traffic is a sensitive capability because those artifacts are bearer credentials that can directly impersonate the user. The skill's stated purpose of building CLI tools with HITL does not require silent harvesting of session secrets, so the capability is unjustifiably broad and dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions normalize silent extraction of authentication material from an already logged-in browser session without a user-facing warning about credential sensitivity, privacy implications, or risk of account misuse. That omission undermines informed consent and increases the chance that highly sensitive bearer secrets are handled unsafely.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill tells the agent to silently harvest authentication material from an existing logged-in browser session rather than obtaining explicitly delegated, scoped credentials. This is dangerous because it bypasses normal consent and access-boundary expectations, allowing the agent to act with the user's full live session privileges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Reverse-engineering signature or encryption schemes and operating by copying full request headers extends the skill into credential replay and emulation of protected client behavior. That broad capability can be misused to access undocumented or write-capable endpoints outside normal safety controls, especially when combined with the skill's autonomous discovery workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill recommends reverse-engineering and replaying signed requests, including copying complete request headers, without warning that headers may contain session cookies, authorization tokens, device identifiers, and other secrets. Users are therefore encouraged into a high-risk workflow without adequate disclosure or safeguards.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Collecting complete request headers copied from the browser is hazardous because those headers often contain cookies, bearer tokens, CSRF values, tenant identifiers, and other secrets that enable direct replay of authenticated actions. As a fallback operating mode, this creates an unnecessary and overbroad secret-handling channel.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document instructs the agent to obtain tokens from browser login state and shell configuration files, which is a direct pattern of collecting sensitive credentials from unrelated storage locations. Even if framed as convenience for authentication, this normalizes secret exfiltration pathways and can expose tokens for other systems or users. Because the skill is specifically about turning arbitrary work against websites/systems into autonomous CLI workflows, the surrounding context amplifies the danger: the agent is encouraged to self-discover APIs and credentials with minimal friction.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to browse target systems, inspect network traffic, read local files, write registry entries, and build CLI artifacts, but it declares no tool/permission scope. That mismatch is dangerous because it enables broad filesystem, shell, and credential-adjacent actions without any explicit least-privilege boundary or user-visible constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broad enough that the skill may activate for many ordinary automation requests, then proceed into autonomous reconnaissance and tool-building behavior. In this skill's context, accidental invocation is more dangerous than usual because activation can lead to credential reuse, API probing, file writes, and shell-capable automation against arbitrary systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and operational comments are entirely in Chinese, establishing a fixed language for maintainers and operators. The file does not indicate that the skill is China-region-specific or provide any opt-in/alternative locale, which fits the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · demo/cli/order-system/_guard_client.py (reported line 79)May include surrounding context.

python

raise NotApproved(json.dumps({"approved": False,
                                      "reason": f"guard daemon not running and GUARD_DAEMON_SCRIPT unset ({DAEMON_PID})"}))
    SPOOL_ROOT.mkdir(parents=True, exist_ok=True)
    subprocess.Popen([sys.executable, DAEMON_SCRIPT],
                     stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                     start_new_session=True)
    deadline = time.time() + 10

Tainted flow: 'DAEMON_SCRIPT' from os.environ.get (line 38, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow
• Confidence: 95% confidence

Finding

The daemon script path is taken directly from the GUARD_DAEMON_SCRIPT environment variable and then executed as Python code. Any attacker who can influence the process environment can cause arbitrary local code execution in the context of this CLI, which is especially sensitive in a tool explicitly designed to guard write operations.

Content

Scanner excerpt · demo/cli/order-system/_guard_client.py (reported line 79)May include surrounding context.

python

raise NotApproved(json.dumps({"approved": False,
                                      "reason": f"guard daemon not running and GUARD_DAEMON_SCRIPT unset ({DAEMON_PID})"}))
    SPOOL_ROOT.mkdir(parents=True, exist_ok=True)
    subprocess.Popen([sys.executable, DAEMON_SCRIPT],
                     stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
                     start_new_session=True)
    deadline = time.time() + 10

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The interactive approval card shown to users contains only Chinese text such as the title, field labels, and approval instructions. Because this is direct user-facing language and no locale choice or justification is provided, it constitutes a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language instructions, examples, and CLI help text entirely in Chinese, including user-facing messages and usage guidance. The file does not indicate that Chinese is optional or region-specific, so it effectively imposes a specific language/locale without user opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · demo/cli/order-system/_guard_client.py (reported line 97)May include surrounding context.

python

if profile:
        argv += ["--profile", profile]
    argv += list(args)
    proc = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
    if proc.returncode != 0:
        raise RuntimeError(f"lark-cli failed: {proc.stderr.strip()[:300]}")
    return json.loads(proc.stdout)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · demo/guard/feishu_guard_daemon.py (reported line 75)May include surrounding context.

python

if profile:
        argv += ["--profile", profile]
    argv += list(args)
    proc = subprocess.run(argv, capture_output=True, text=True, timeout=timeout)
    if proc.returncode != 0:
        raise RuntimeError(f"lark-cli failed: {proc.stderr.strip()[:300]}")
    return json.loads(proc.stdout)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The daemon forwards output_tail from CLI execution results directly into Feishu messages/cards, which can expose sensitive data such as tokens, PII, internal URLs, or command output from write operations to chat recipients. In this skill context, the daemon is a shared global approval/result channel for many tools, so accidental data leakage is more dangerous because multiple systems' outputs may be relayed through the same messaging account and chat context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file is written as a prescriptive Chinese-language skill and includes user-facing phrases in Chinese, but it does not state that language choice is optional or limited to a justified region-specific context. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to reuse an existing logged-in browser session and automatically extract cookies or tokens from observed requests without first requiring explicit, scoped credential delegation. That materially expands the skill from API surveying into credential capture and session hijacking territory, creating a path to unintended account access beyond the user's informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Guidance to reverse frontend signing or encryption logic and replay full authenticated request headers gives the agent operational techniques for bypassing intended client controls and reproducing privileged requests outside the normal application boundary. In this context, that is more than harmless interoperability guidance because it enables reproduction of sensitive authenticated actions using harvested browser material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guidance explicitly tells the agent/CLI to pull authentication material from shell startup files and, if needed, from an already logged-in browser session. That creates a credential-harvesting pattern beyond the immediate command invocation and does so without requiring just-in-time user consent or a narrow least-privilege boundary. In this skill’s context—autonomously exploring external systems and generating tools—this is more dangerous because it encourages broad secret collection during reconnaissance and normal operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly tells users to record authentication details such as how to obtain tokens, cache locations, and token lifetime in persistent registry files. In the context of a self-evolving skill that continuously writes back operational knowledge, this creates a real risk of credential leakage, token theft, and overexposure of sensitive auth internals if the registry is shared, synced, or later processed by other agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The template explicitly instructs operators to rely on environment variables, cached token files, and browser login state as authentication sources, but provides no guidance on secure handling, storage, or redaction of those sensitive credentials. In this skill’s context—automating internal systems and generating reusable CLI tools—this omission can normalize unsafe practices such as persisting tokens in plaintext, leaking tokens into logs or docs, or reusing browser session state without adequate isolation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

L035-L040 以“我每天都 XXX，能不能自动化”“把我的工作做成工具”等通用诉求作为使用条件，但未说明哪些自动化需求不适用，也未限定必须与网站勘察、CLI 产出或飞书审批相关。对 markdown 技能说明而言，这会放大与普通效率类请求的语义重叠。

Content

No source excerpt is available for this finding.