lark-meeting

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for booking Lark meeting rooms, but it uses authenticated calendar access and under-discloses sensitive meeting data written to logs, so it should be reviewed before installation.

Install only if you are comfortable letting the skill use your logged-in Lark account to create calendar events and reserve rooms. Review or disable debug logging before use, confirm exact time/title/room details before every booking, and avoid running the suggested sudo ownership command unless you personally verify the path and need it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/utils.py:20
• Finding: Sensitive meeting and calendar data is written to plaintext debug logs## Vulnerability Details **File Location**: `scripts/utils.py`, lines 20–31 **Vulnerability Type**: Plaintext sensitive-data logging **Risk Level**: Medium ### Vulnerable Code ```python logger.debug(f"执行命令: {' '.join(cmd)}") try: result = subprocess.run( cmd, capture_output=True, text=True, check=True ) response = json.loads(result.stdout) logger.debug(f"API 响应: {response}") ``` ### Technical Analysis Every Lark API command is logged after its request parameters and request body have been serialized into the command argument list. The complete parsed API response is then also logged. Depending on the operation, these log entries can contain: - Meeting subjects and descriptions. - Meeting start and end times. - Room IDs and room names. - Calendar IDs and event IDs. - Organizational room hierarchy and availability data. - Attendee records and calendar metadata. - Other information returned by the Lark API. For example, `create_calendar_event` places the meeting subject, description, and timestamps in the `data` argument. `_run_lark_cli_api` serializes that object with `json.dumps` and includes the resulting plaintext JSON in the debug log. Multiple methods in `scripts/lark_cli.py` also log API results, including room-search results, availability responses, and primary-calendar metadata. Authentication tokens are not explicitly passed by this project and were not found in the reviewed code, but the request and response content can still contain confidential business and organizational data. Sending meeting information to Lark is necessary for the declared booking functionality. Writing the complete information to local or orchestrator logs is not necessary and exceeds minimum data exposure. ### Attack Path 1. A user or automation invokes the booking or initialization workflow. 2. Meeting details and identifiers are passed to `lark-cli` in the `--data` or `--params` arguments. 3. `_run_lark_cli_api` write ...[truncated 1305 chars]
• Remediation: ## Remediation Suggestions 1. Remove logging of complete command arguments and API responses. 2. Log only non-sensitive operational metadata, such as: - HTTP method. - Static endpoint template. - Success or failure status. - Response code. - Number of records returned. 3. Implement a centralized redaction function for fields including `summary`, `description`, timestamps, calendar IDs, event IDs, room IDs, attendees, page tokens, and any future credential fields. 4. Do not reconstruct the complete command with `' '.join(cmd)` for logging. 5. Use structured logging with an explicit allowlist rather than attempting to denylist sensitive fields. 6. Disable debug logging by default in production and ensure retained logs have restrictive permissions and short retention periods. 7. Avoid returning complete stderr from `lark-cli` to higher-level exception messages unless it has been sanitized. 8. Review and remove the additional full-response logs in `scripts/lark_cli.py`, especially room search, availability, and primary-calendar operations. 9. Add automated tests that submit marker secrets in meeting descriptions and verify that the markers never appear in captured logs.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/meeting_processor.py:95
• Finding: Incomplete or malformed availability responses are treated as proof that a room is free## Vulnerability Details **File Location**: `scripts/meeting_processor.py`, lines 95–129 **Vulnerability Type**: Fail-open availability validation **Risk Level**: Low ### Vulnerable Code ```python if not isinstance(periods, list): merged_free_busy[key] = [] continue merged_free_busy[key] = [p for p in periods if isinstance(p, dict)] ``` ```python rid = str(room_id) if rid in error_room_ids: return False if rid not in merged_free_busy: return True periods = merged_free_busy[rid] if not periods: return True for p in periods: try: bs = _parse_iso_dt(str(p.get("start_time", ""))) be = _parse_iso_dt(str(p.get("end_time", ""))) except (TypeError, ValueError): continue if _intervals_overlap(q_start, q_end, bs, be): return False return True ``` ### Technical Analysis The booking workflow treats several uncertain states as confirmation that a room is available: - A requested room missing from `free_busy` is considered available. - A non-list availability value is converted to an empty list and considered available. - Non-dictionary availability entries are discarded. - Busy periods with invalid or missing timestamps are ignored. - If all reported periods are malformed, the room is considered available. This is a fail-open design. Absence of valid availability evidence is not equivalent to positive confirmation that the room is free. A truncated, schema-changed, corrupted, or unexpectedly structured successful API response can therefore cause the Skill to select a room whose availability was never reliably established. The Lark calendar service may reject the subsequent room-attendee request if the resource is already occupied, which limits the impact. However, the workflow creates the calendar event before attaching the room. A false availability decision can consequently leave an event created without a successfully reserved meeting room. ### Attack Path 1. The Skill submits a batch availability ...[truncated 1399 chars]
• Remediation: ## Remediation Suggestions 1. Change availability evaluation to fail closed: - A requested room missing from the response must be considered unavailable or indeterminate. - A non-list value must be treated as a response error. - Invalid period entries or timestamps must invalidate that room's result. 2. Verify that every requested room ID appears in either a valid `free_busy` result or `error_room_ids`. 3. Reject duplicate, unknown, or structurally invalid room records. 4. Validate the complete response against an explicit schema before selecting a room. 5. Retry indeterminate availability results with bounded retries and backoff. 6. If reliable availability cannot be established, stop before creating the calendar event and provide an actionable error. 7. Add transactional compensation: if attaching or verifying the meeting room fails after event creation, delete the newly created event or clearly offer an automatic rollback. 8. Add tests for omitted room IDs, `null` values, non-list periods, malformed timestamps, truncated batches, and partial successful responses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose says the skill helps book meeting rooms, but the content also includes local configuration editing, initialization workflows, blacklist management, and cached room inventory updates. This mismatch can mislead users and orchestration systems about what the skill is authorized to do, causing unexpected file changes or broader operational actions than the user intended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose says the skill helps book meeting rooms, but the content also includes local configuration editing, initialization workflows, blacklist management, and cached room inventory updates. This mismatch can mislead users and orchestration systems about what the skill is authorized to do, causing unexpected file changes or broader operational actions than the user intended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose says the skill helps book meeting rooms, but the content also includes local configuration editing, initialization workflows, blacklist management, and cached room inventory updates. This mismatch can mislead users and orchestration systems about what the skill is authorized to do, causing unexpected file changes or broader operational actions than the user intended.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation instructs the agent to read and write local configuration files and execute shell commands, but it does not declare any explicit tool scope or permission boundaries. This creates an authority gap where a caller may not realize the skill can modify the filesystem and invoke local commands, increasing the chance of unintended or over-privileged execution.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger text says to execute the skill whenever the user needs to book a meeting room, but it does not define boundaries for when initialization, config mutation, or blacklist editing are allowed. Broad activation criteria can cause the agent to invoke shell and file-writing actions in situations where the user only intended a simple informational response.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill performs side effects including editing local JSON files and creating calendar bookings, but these risks are not surfaced as strong warnings up front. Users may not appreciate that invoking the skill can persist changes locally and create external bookings, leading to accidental data modification or unwanted calendar actions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- 改 **名称 / room_id** 规则后，**无需重跑初始化**即可影响下次预约（预约脚本会读黑名单）。  
- 改 **容量**规则或希望 **从飞书重新拉全量列表** 时，在用户确认后**再执行一次** `meeting_init_processor.py`（同城市/大厦/楼层），以刷新 `meeting.json` 中的 `rooms`。

**权限提示：**若无法写入 `conf/`，可提示用户在终端授权，例如：`sudo chown -R $(whoami):staff <技能仓库>/conf/`（路径按实际技能目录替换）。

## 入口命令（在仓库根目录执行）

• Confidence: 89% confidence
• Finding: The documentation suggests a sudo-based ownership change command on a repository path to enable writes. Even as an example, normalizing privileged shell use in a skill increases the chance of unsafe execution, path substitution mistakes, or broader filesystem permission changes than necessary.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The blacklist is keyed on the Chinese substring "面试间", which imposes a language-specific matching rule. In this file there is no indication that users can choose locale behavior or that the restriction is justified as a region-specific configuration, so it may violate language/locale policy requirements.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation for get_primary_calendar explicitly states "GET /open-apis/calendar/v4/calendars/primary", which describes a read-style metadata lookup. However, the implementation invokes run_lark_cli_as_user with the HTTP method "POST". This is an active contradiction between the documented intent and the actual code behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This function performs a user-scoped state-changing action that creates calendar events, but the file contains no built-in authorization gate, confirmation requirement, or caller-side safeguard. In an agent skill that books meeting rooms, this is more dangerous because natural-language prompting or tool misuse could cause unintended event creation on a user's calendar without sufficiently explicit consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Adding attendees/resources is a user-scoped write that can modify an event and reserve meeting rooms, yet this wrapper exposes the action without any explicit confirmation or safety interlock. In this skill context, that can lead to unauthorized room reservations, accidental invitations, or workflow abuse if an upstream agent triggers the function from ambiguous or manipulated user input.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The surrounding calendar operations consistently document user-scoped access for calendar resources, and list_calendar_event_attendees explicitly says calendar attendee retrieval should use user identity. In contrast, get_calendar_events fetches calendar events via run_lark_cli_as_bot, which diverges from the documented identity model used for the same calendar domain. This creates an intent/code mismatch about which principal is supposed to access user calendar data.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This Python file contains natural-language descriptions and CLI prompts entirely in Chinese, including the module docstring and command-line help text. Because the file does not offer any user opt-in for language selection or explain that the tool is intentionally region-specific, it violates the language/locale policy criterion.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This Python file contains user-facing natural-language descriptions exclusively in Chinese, including the module docstring and operational requirements. Under the stated policy, forcing a specific language without offering a language or locale choice is a natural-language policy violation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.debug(f"执行命令: {' '.join(cmd)}")

    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The file presents the skill entirely in Chinese and specifies default time parsing in China Standard Time (`+08:00`) without offering a user language or locale choice. This can amount to a locale policy issue when the skill implicitly assumes a fixed language/region rather than allowing user opt-in or clarifying that it is region-specific.

Static analysis

No suspicious patterns detected.