Feishu lark-cli Setup Guide

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 1.0.0

Overview

This skill clearly sets up Feishu access, but it asks for very broad account permissions and creates ongoing token refresh without enough scoping or revocation guidance.

Review this skill carefully before installing. Use it only if you truly want broad Feishu/Lark access enabled for the agent across documents, mail, messages, calendars, approvals, and other business data. Prefer pinned or locally controlled CLI installation, request only the domains you need where possible, and create any token-refresh schedule only after you understand how to disable and revoke it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:51

Finding

Unpinned Global CLI Installation from a Third-Party Registry

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 51
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: High

Vulnerable Code:

bash

npm install -g @larksuite/cli --registry https://registry.npmmirror.com

Technical Analysis

The Skill instructs users to install the latest available version of @larksuite/cli globally from registry.npmmirror.com, rather than pinning a reviewed version from the official registry. No package version, integrity hash, signature, or provenance validation is specified.

A global npm installation may execute package lifecycle scripts with the privileges of the invoking user. The effective code installed by this command can also change after the Skill has been audited because the version is not pinned. Consequently, compromise of the package, its dependencies, the configured registry, or a future package release could introduce arbitrary executable code.

Attack Path

1. An attacker compromises the configured registry, the package publication account, or a transitive dependency.
2. The attacker publishes or serves a modified version of @larksuite/cli.
3. A user follows the Skill and executes the unpinned global installation command.
4. Malicious package lifecycle code or CLI code executes with the user's npm permissions.
5. The installed global command can subsequently access local files, authorization tokens, environment variables, or Feishu data made available during later steps.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. Because the package is installed globally and later handles broad Feishu authorization, compromise could affect local user data, authentication tokens, Feishu business information, and subsequent lark-cli operations. The exact system-level impact depends on the privileges used to run npm.

Remediation

View remediation

Remediation Suggestions

• Install from the official npm registry unless a separately verified and trusted internal mirror is required.
• Pin an exact, reviewed package version, for example @larksuite/cli@X.Y.Z.
• Verify package integrity, publisher identity, signatures, and provenance before installation.
• Review the selected package version and its transitive dependency tree.
• Prefer a project-local installation with a lockfile instead of a global installation.
• Disable lifecycle scripts during installation where compatible, and run the CLI in a sandbox or least-privileged environment.
• Establish a controlled update process rather than automatically resolving the newest available release.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:69

Finding

All-Domain Feishu Authorization Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69 and 151
Vulnerability Type: Excessive account authorization scope
Risk Level: High

Vulnerable Code:

bash

lark-cli auth login --domain all --no-wait --json 2>&1

The permission-error recovery procedure repeats the same broad authorization model:

bash

lark-cli auth login --domain all

Technical Analysis

The --domain all option requests authorization across all supported Feishu capability domains rather than limiting access to the specific feature requested by the user. The Skill advertises access to documents, spreadsheets, calendars, messages, mail, tasks, knowledge bases, meeting records, OKRs, and approvals.

This creates an unnecessarily broad authorization boundary. Even if the authorization flow requires user consent, bundling unrelated sensitive capabilities into a single setup operation conflicts with least-privilege and purpose-limitation principles. Any compromise or misuse of the resulting token or CLI can therefore affect substantially more data than is required for an individual task.

Attack Path

1. A user requests setup for one or a limited set of Feishu features.
2. The Skill invokes login with --domain all.
3. The user approves the broad authorization through the supplied verification URL or QR code.
4. The resulting credentials grant access across multiple Feishu service domains.
5. A compromised CLI, stolen token, malicious local process, or unauthorized operator uses the excessive permissions to read or modify unrelated Feishu resources.

Impact Assessment

Depending on the scopes ultimately approved and organizational policy, exposed privileges may include access to mail, messages, documents, calendars, tasks, knowledge-base content, OKRs, approval records, spreadsheets, and other business data. Potential consequences include confidentiality loss, unauthorized modification, message o ...[truncated 106 chars]

Remediation

View remediation

Remediation Suggestions

• Replace --domain all with task-specific domains and the minimum scopes required for the requested operation.
• Separate sensitive capabilities such as mail, messages, documents, and approvals into independent opt-in authorization flows.
• Present the exact requested scopes and their consequences before initiating authorization.
• Require explicit user confirmation before adding each sensitive domain.
• Do not treat reauthorization with all domains as the default response to a permission error; request only the scope identified by the error.
• Provide commands and documentation for reviewing and revoking granted permissions.
• Apply short token lifetimes and organizational access controls to particularly sensitive resources.

T06 · System Persistence

Error

• Location: SKILL.md:109

Finding

Persistent Scheduled Agent Task Maintains Feishu Authorization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 109-130
Vulnerability Type: Cross-session scheduled token renewal
Risk Level: High

Vulnerable Configuration:

text

Every Monday at 09:00 automatically execute lark-cli auth refresh

schedule.kind: "cron"
schedule.expr: "0 9 * * 1"
schedule.tz: "Asia/Shanghai"
payload.kind: "agentTurn"
payload.message: see the template below
sessionTarget: "isolated"
delivery.mode: "announce"

The scheduled payload directs the Agent to run:

bash

lark-cli auth refresh --json

Technical Analysis

The Skill directs OpenClaw to create a recurring cron job that launches an isolated Agent turn and refreshes the Feishu authorization token every week. This scheduled task survives the initial setup run and extends account access across future sessions.

Persistence is particularly sensitive here because the refreshed credentials are associated with the broad authorization requested elsewhere in the Skill. The documentation does not require explicit, informed consent before creating the task, define an automatic expiration date, limit the number of refreshes, or provide a removal procedure.

Attack Path

1. The user grants Feishu authorization during setup.
2. The Skill creates the weekly OpenClaw cron task.
3. The initial setup session ends, but the scheduled task remains active.
4. Each scheduled Agent turn executes lark-cli auth refresh --json.
5. The refreshed credentials continue to provide account access.
6. If the CLI, Agent environment, scheduled payload, or local account is later compromised, the attacker can leverage repeatedly renewed credentials instead of waiting for the original authorization to expire.

Impact Assessment

The task extends the lifetime of Feishu account access and creates a recurring execution point in the Agent environment. Compromise could preserve access to any approved Feishu domains, including ...[truncated 177 chars]

Remediation

View remediation

Remediation Suggestions

• Do not create a recurring task by default; require separate, explicit consent after explaining its persistence and credential implications.
• Prefer manual refresh or refresh only when the user initiates an operation that requires it.
• If scheduling is necessary, define an expiration date, a maximum number of executions, and a narrowly scoped service identity.
• Provide the exact command or user-interface procedure needed to inspect, disable, and delete the cron job.
• Notify the user on every refresh and immediately report unexpected scope or identity changes.
• Protect token storage with restrictive filesystem permissions and operating-system credential storage where available.
• Combine renewal with least-privilege authorization rather than refreshing an all-domain token.
• Audit changes to the scheduled payload and prevent untrusted parties from modifying the cron configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to obtain broad Feishu user authorization across many product areas and to set up automatic token refresh, but it does not require clear, explicit user consent describing the resulting ongoing access to documents, mail, messages, calendar, knowledge base, approvals, and other sensitive account data. This is dangerous because users may believe they are enabling a narrow setup step while actually granting durable, multi-service account access that can later be used for extensive data retrieval and actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.