Lark

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:06 AM UTC
• Version: 1.0.1

Overview

This appears to be a real Feishu/Lark integration, but it needs Review because setup runs mutable npm code with app secrets and the instructions enable broad workplace read, write, and delete actions without strong guardrails.

Install only if you trust the Lark MCP package and need broad Feishu/Lark automation. Pin and review the MCP package version before use, avoid putting app secrets on the command line, grant only the Lark scopes needed for your workflow, and require explicit user confirmation before destructive actions or access to recordings, transcripts, approvals, and private documents.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:23
• Finding: Unpinned npm Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-26` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```yaml mcp_servers: - name: lark-mcp package: "@larksuiteoapi/lark-mcp" source: "https://github.com/larksuite/lark-openapi-mcp" description: "Official Feishu/Lark OpenAPI MCP server — install with: npx -y @larksuiteoapi/lark-mcp mcp -a $LARK_APP_ID -s $LARK_APP_SECRET" ``` The same unsafe installation pattern is repeated at `SKILL.md:32-33` and `SKILL.md:1419`. ### Technical Analysis The documented command uses `npx -y` to retrieve and execute `@larksuiteoapi/lark-mcp` without an exact version, lockfile, or integrity hash. The `-y` option also suppresses the normal installation confirmation. Consequently, the code executed at setup time is determined by the package version resolved from the npm registry at that moment rather than by the content reviewed in this project. Although the package is identified as the official Lark MCP implementation, this project does not cryptographically bind installation to a reviewed artifact. A compromised package release, maintainer account, registry response, or unexpectedly unsafe future release could therefore execute arbitrary code in the local process. The package also receives the Lark application identifier and secret when started, increasing the consequences of dependency compromise. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or the relevant release process. 2. The attacker publishes a modified version under the expected package name. 3. A user follows the Skill documentation and runs the unversioned `npx -y` command. 4. `npx` resolves and downloads the attacker-controlled release without interactive confirmation. 5. Package installation hooks or runtime code execute with the privileges of the invoking user. 6. The malicious package can access the Lark credentials supplied at start ...[truncated 731 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an exact, reviewed version, for example: ```bash npx --yes @larksuiteoapi/lark-mcp@<audited-exact-version> mcp ``` 2. Prefer installing through a project manifest and lockfile rather than resolving the package dynamically during every invocation. 3. Verify package integrity using the package manager's integrity metadata or a separately published cryptographic checksum. 4. Document the expected npm publisher, repository, version, and release checksum so users can verify provenance. 5. Remove automatic confirmation where practical and explain that the command downloads and executes third-party code. 6. Run the MCP server under a dedicated, minimally privileged operating-system account or container. 7. Restrict the Lark application to only the API scopes required for the intended deployment. 8. Review new package versions before updating the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:32
• Finding: Lark Application Secret Is Passed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-33` **Vulnerability Type**: Sensitive credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```markdown > Setup: `npx -y @larksuiteoapi/lark-mcp mcp -a <APP_ID> -s <APP_SECRET>` > For user-identity APIs (useUAT): first run `npx -y @larksuiteoapi/lark-mcp login -a <APP_ID> -s <APP_SECRET>` ``` An environment-variable variant that still expands the secret into the process argument vector also appears at `SKILL.md:26`: ```text npx -y @larksuiteoapi/lark-mcp mcp -a $LARK_APP_ID -s $LARK_APP_SECRET ``` ### Technical Analysis The instructions supply the application secret through the `-s` command-line option. Shell expansion of `$LARK_APP_SECRET` does not prevent exposure: the expanded value is placed in the child process's argument vector. Depending on the operating system and deployment environment, process arguments may be observable through process-listing utilities, process inspection interfaces, monitoring agents, crash reports, audit logs, orchestration metadata, or diagnostic tooling. Entering a literal secret can additionally expose it through shell history. This exposure is not an unrelated exfiltration channel—the secret is required to authenticate the Lark MCP integration—but the documented transport mechanism unnecessarily increases local disclosure risk. ### Attack Path 1. An administrator starts the MCP server or login flow using the documented command. 2. The shell expands the secret into the command's argument vector, or a literal secret is recorded in shell history. 3. Another local user, monitoring component, support bundle, audit system, or diagnostic tool records or reads the process arguments or command history. 4. The observer extracts the Lark application secret. 5. The observer uses the application identifier and secret to authenticate as the Lark application. 6. The observer accesses APIs and organizational data allowed by th ...[truncated 733 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a credential input mechanism that does not place the secret in the process argument vector, such as: - standard input; - an operating-system credential store; - a permission-restricted configuration file; - a file-descriptor-based secret; - a supported environment-only configuration mechanism where the child reads the variable directly. 2. If the MCP package supports environment-based configuration, invoke it without expanding the secret into an argument: ```bash export LARK_APP_ID="..." export LARK_APP_SECRET="..." npx --yes @larksuiteoapi/lark-mcp@<audited-exact-version> mcp ``` The application itself must read these variables; the command must not pass `$LARK_APP_SECRET` as an argument. 3. Warn users never to substitute a literal secret into commands that may be retained in shell history. 4. Restrict secret-containing files to the service account, such as mode `0600` on Unix-like systems. 5. Configure monitoring, audit, and diagnostic systems to redact Lark credentials. 6. Rotate the application secret if it has previously appeared in process captures, logs, support bundles, or command history. 7. Apply least-privilege Lark scopes so credential compromise does not expose the complete set of capabilities documented by the Skill. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill instructs users to launch the MCP server via an unpinned npm package using `npx -y @larksuiteoapi/lark-mcp`, which fetches the latest published code at runtime. Because this command is paired with app credentials (`-a` and `-s`), a compromised or malicious upstream release could immediately gain access to sensitive secrets and the user's Feishu/Lark environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This line again tells the user to execute an unpinned `npx` package directly from the npm registry. In this context the command is used for authentication/login, so a supply-chain compromise could capture app credentials or user access tokens and enable unauthorized access to messages, docs, calendars, and other enterprise data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill recommends enabling additional VC and Minutes scopes through the same unpinned `npx` package invocation, expanding the reachable privilege set while still trusting whatever version is latest. If the package or dependency chain were hijacked, the attacker would gain access not only to chat and docs but also meeting reservations, recordings, and transcripts.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Several examples assume Chinese locale conventions, including `zh_cn` content structures, `Asia/Shanghai` timezone values, and approval locale parameters set to `zh-CN`. Because the file does not explicitly offer language or locale choice in those examples, it risks forcing a specific locale contrary to the policy on user opt-in.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill encourages reading messages, user profiles, calendars, documents, approvals, meeting recordings, and minutes transcripts without prominent privacy or data-minimization guidance. In a workplace integration, this can normalize broad access to sensitive organizational and personal data and increase the chance of over-collection or inappropriate disclosure.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents many destructive operations—deleting chats, files, records, tasks, reservations, and ending meetings—without requiring confirmation language or warning about irreversibility. In an agentic context, that omission raises the risk of accidental or prompt-induced destructive actions against real organizational resources.

Session Persistence

Medium

• Category: Rogue Agent

Content

useUAT: true
```

### Add Task to a Task List
**Tool**: `mcp__lark-mcp__task.v2.task.addTasklist`
```yaml
path:

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The troubleshooting guidance repeats an unpinned `npx` execution path, reinforcing insecure operational practice. Repetition increases the chance users will copy-paste the command during setup or incident response, potentially exposing credentials to a compromised upstream package when they are under pressure and less likely to verify provenance.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This login refresh instruction again invokes an unpinned package while handling user access tokens, creating a direct supply-chain path to token theft or session abuse. Because the skill targets broad enterprise collaboration data, stolen tokens could enable significant lateral access across chats, drive files, tasks, approvals, and meeting content.

Static analysis

No suspicious patterns detected.