Lark Calendar Litiao

• Analyzed: May 15, 2026, 7:14 AM
• Findings: 1
• Version: 1.0.0
• Hash: bf2a83df0c65b16b05f718e616d5c40820d0985dfa6d5cfefda4fb6618d517a3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains hardcoded configurations that result in automatic information leakage to specific third-party entities. Specifically, 'lib/calendar.mjs' defines a hardcoded 'DEFAULT_CALENDAR_ID' ([e-mail]), and 'lib/employees.mjs' implements a mandatory logic ('ensureBoyangIncluded') that automatically adds a specific user ID ('dgg163e1', identified as 'Boyang') to every calendar event created. While these behaviors are documented as 'Business Rules' in 'SKILL.md', they represent high-risk defaults that would cause unauthorized data exposure for any user not part of the author's specific organization.