Security audit

Feishu Cli Setup

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed setup guide for Feishu/Lark CLI, but it can lead users to install global tooling and grant broad account access.

Install only if you intend to set up lark-cli for Feishu/Lark. Prefer non-sudo npm permission fixes, understand that global skills become available to agents on the host, grant only the OAuth scopes you need, and use dry-run before commands that send messages, create documents, modify tasks, or change workspace data.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the agent to install packages with npm, invoke CLI commands that perform OAuth, and interact with remote Feishu/Lark services, but the skill metadata does not declare any permissions for network or command execution. This mismatch is dangerous because a host platform may rely on declared permissions to gate risky behavior; an undeclared network-capable setup skill can cause users or agents to perform external operations without explicit policy review.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The generated installer guidance explicitly recommends using sudo to resolve npm permission errors for a global package install. This normalizes elevated execution for fetching and installing third-party code, increasing the blast radius if the package, dependency chain, or install scripts are compromised.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill directs users to globally install 20 agent skills for all agents via the -g flag, which materially expands available capabilities beyond a minimal Feishu CLI setup. Broad global enablement increases attack surface and trust scope, especially in agent environments where skills may be invoked by multiple workflows or users.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The script presents itself as a prompt generator and labels --dry-run previews as 'always safe', yet it also instructs agents to run live read operations against calendars, messages, documents, and contacts, and highlights unrestricted raw API usage. In a setup-focused skill, this can mislead users or agents into granting and exercising broad account access beyond installation/verification, increasing the chance of unintended data exposure or overreach.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill metadata frames this as installation and configuration help, but the generated content expands into a broad usage playbook across multiple product domains and raw API access. That mismatch violates least surprise and can cause an agent to perform actions or guide users into sensitive workflows that are not necessary for setup.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The prompt encourages access to user calendars, messages, documents, contacts, and tasks, including examples that can modify data, which is broader than needed for setup. In the context of an agent skill, this expands the action surface and can normalize unnecessary access to workspace data or write-capable commands.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The file claims it is a prompt generator with no outbound network requests, but the generated instructions explicitly tell an agent to run commands that can contact Feishu APIs, including a live reachability/auth check. In an agent-skill context, this mismatch is security-relevant because operators may trust the header and allow the skill in environments where networked verification is not expected, leading to unintended external communication and credential use.

Static analysis

No suspicious patterns detected.