Lark All In One

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:07 AM UTC
• Version: 0.1.4

Overview

This is a real Lark automation skill, but it asks for broad workspace authority and includes risky setup patterns without enough user safeguards.

Install only if you need broad Feishu/Lark automation and can control the granted scopes. Pin and verify the MCP package version, avoid typing secrets directly into shell commands, use app identity or read-only scopes where possible, and require explicit human confirmation before deleting data, changing permissions, approving/rejecting workflows, forwarding sensitive content, accessing recordings/transcripts, or managing live meetings. Protect and rotate the app secret and revoke unused user tokens.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23
• Finding: Unpinned Packages Are Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-28` (also documented in `SKILL.md:34-35`, `SKILL.md:1421`, and `README.md:36-58`) **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: Medium ### Vulnerable Code ```yaml mcp_servers: - name: lark-mcp package: "@larksuiteoapi/lark-mcp" source: "https://github.com/larksuite/lark-openapi-mcp" description: "Official Feishu/Lark OpenAPI MCP server" command: "npx" args: ["-y", "@larksuiteoapi/lark-mcp", "mcp", "-a", "$LARK_APP_ID", "-s", "$LARK_APP_SECRET"] ``` Related installation instructions include: ```bash npm install -g @larksuiteoapi/lark-mcp npx -y @larksuiteoapi/lark-mcp mcp -a <APP_ID> -s <APP_SECRET> npm i -g clawhub ``` ### Technical Analysis The Skill invokes `npx -y` against a package without specifying an exact version. If the package is unavailable locally, `npx` can retrieve the currently resolved release from the package registry and execute it immediately. The `-y` option suppresses the normal confirmation prompt. The global installation commands are likewise not version-pinned. Consequently, the code executed during installation or startup can change after the Skill itself has been reviewed. The repository metadata identifies an apparently official Lark package, and there is no evidence that the current package is malicious. Nevertheless, the configuration does not bind execution to a reviewed artifact, version, or integrity digest. This creates a supply-chain exposure if the package registry account, upstream release pipeline, package namespace, or a transitive dependency is compromised. ### Attack Path 1. An attacker compromises the upstream package publisher, release pipeline, registry account, or a dependency included in a future package version. 2. The attacker publishes a malicious release under the expected package name. 3. A user installs or starts the Skill using the documented unpinned `npm` or `npx -y` command. ...[truncated 1111 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@larksuiteoapi/lark-mcp` and `clawhub` to exact, reviewed versions rather than floating latest releases. 2. Remove `-y` so that unexpected package retrieval is not silently approved. 3. Install dependencies through a lockfile-backed deployment process and verify package integrity hashes. 4. Prefer a preinstalled, reviewed executable instead of allowing Skill startup to fetch executable code dynamically. 5. Run the MCP server in a dedicated, unprivileged account or container with access only to required configuration and network destinations. 6. Establish a controlled update process that reviews release notes, source changes, provenance attestations, and dependency changes before upgrading. 7. Where supported, use package-manager provenance verification and an internal trusted registry mirror. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:15
• Finding: Lark Application Secret Is Passed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-28` (also documented in `SKILL.md:34-35` and `README.md:48-58`) **Vulnerability Type**: Credential exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```yaml requires: env: - name: LARK_APP_ID description: "Your Feishu/Lark App ID from the Open Platform developer console (open.feishu.cn/app or open.larksuite.com/app)" sensitive: false - name: LARK_APP_SECRET description: "Your Feishu/Lark App Secret from the Open Platform developer console" sensitive: true mcp_servers: - name: lark-mcp package: "@larksuiteoapi/lark-mcp" source: "https://github.com/larksuite/lark-openapi-mcp" description: "Official Feishu/Lark OpenAPI MCP server" command: "npx" args: ["-y", "@larksuiteoapi/lark-mcp", "mcp", "-a", "$LARK_APP_ID", "-s", "$LARK_APP_SECRET"] ``` The user-facing setup instructions also recommend: ```bash npx -y @larksuiteoapi/lark-mcp mcp -a <APP_ID> -s <APP_SECRET> npx -y @larksuiteoapi/lark-mcp login -a <APP_ID> -s <APP_SECRET> ``` ### Technical Analysis The configuration correctly marks `LARK_APP_SECRET` as sensitive, but then expands it into the MCP server's process argument list through the `-s` option. Command-line arguments are commonly visible through process-inspection interfaces and may also be captured by: - Shell history when users substitute literal values - Terminal session recording - Process monitoring and observability agents - Diagnostic bundles - CI/CD job logs - Crash reports or command auditing systems Passing a secret in an argument is not equivalent to intentionally transmitting it to an attacker, and the credential is legitimately required for Lark authentication. However, this transport mechanism exposes the credential to more local components than necessary and conflicts with least-exposure handling of sensitive values. ### Attack Path 1. A user follows the setup ins ...[truncated 1439 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place `LARK_APP_SECRET` in the process argument vector. 2. Configure the MCP server to read the secret directly from a protected environment variable, standard input, an operating-system credential store, or a permission-restricted configuration file. 3. If the upstream MCP server only supports `-s`, request or implement a secure environment-variable or file-descriptor option before recommending production use. 4. Update the README so users are not instructed to type literal secrets into interactive shell commands. 5. Disable shell history temporarily only as a last-resort compatibility measure; this does not address process-list or telemetry exposure. 6. Ensure process managers, CI systems, logs, and diagnostic tools redact both the application secret and any access or refresh tokens. 7. Run the service under a dedicated account and restrict process inspection, configuration-file access, and environment access. 8. Rotate the application secret immediately if it has appeared in logs, history, screenshots, telemetry, or support bundles. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:47
• Finding: Default Guidance Encourages Broad User-Authorized Workspace Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:47-50` (scope inventory appears at `SKILL.md:1880-1908` and `README.md:110-127`) **Vulnerability Type**: Excessive default privileges and insufficient separation of read, write, and destructive capabilities **Risk Level**: Low ### Vulnerable Code ```text | `useUAT` | `true` | Act as the logged-in **user** — resources are owned by the user, directly accessible | | `useUAT` | `false` (default) | Act as the **app/bot** — resources owned by the application | Use `useUAT: true` for most interactive operations. Use `false` for background automation. ``` The Skill additionally recommends a broad scope set: ```text | Send messages | `im:message` | | Read messages | `im:message:readonly` | | Group management | `im:chat`, `im:chat:write` | | Bitable (read) | `bitable:app:readonly` | | Bitable (write) | `bitable:app` | | Documents (read) | `docs:doc:readonly` | | Documents (write) | `docs:doc` | | Cloud Drive | `drive:drive` | | Calendar (read) | `calendar:calendar:readonly` | | Calendar (write) | `calendar:calendar` | | Tasks | `task:task:write` | | Contacts | `contact:user.base:readonly` | | Wiki | `wiki:wiki:readonly` | | Approvals | `approval:approval:readonly`, `approval:instance` | | Video Conf (reserve/manage) | `vc:meeting` | | Video Conf (participants) | `vc:meeting:readonly` | | Video Conf (recording) | `vc:record` | | Video Conf (rooms) | `vc:room:readonly` | | Video Conf (export reports) | `vc:export` | ``` ### Technical Analysis The broad capabilities are consistent with the Skill's declared “all-in-one” functionality, so they are not hidden or inherently unauthorized. However, recommending user access tokens for most interactive operations and presenting all feature scopes as a general permission set does not enforce least privilege for individual tasks. Most normal requests need only a small subset of these capabilities. For example, sending one message does not require access to Drive f ...[truncated 2008 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the blanket `useUAT: true` recommendation with task-specific identity guidance. 2. Default to app identity and read-only scopes whenever the requested operation allows it. 3. Publish separate minimal scope profiles for messaging, calendar, documents, meetings, approvals, and other features. 4. Separate read-only and write-capable credentials or MCP configurations. 5. Require explicit user confirmation immediately before destructive or consequential operations, including: - Deleting messages, files, tables, records, events, or tasks - Approving or rejecting workflow instances - Changing collaborators or access permissions - Forwarding messages or transcript-derived content to another chat - Removing meeting participants, changing hosts, or ending meetings - Transferring group ownership 6. Display the intended target, identity, affected resource, recipients, and data classification before confirmation. 7. Limit user-token lifetime, protect refresh tokens, and revoke unused authorizations. 8. Instruct administrators to grant only scopes required for enabled features rather than the complete permission table. 9. Add audit logging and anomaly alerts for bulk reads, exports, permission changes, forwarding, and destructive actions. 10. Treat recordings and transcripts as highly sensitive and prohibit external streaming or redistribution unless the user explicitly authorizes the destination. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README prominently advertises broad capabilities across messaging, files, calendars, recordings, approvals, and transcripts but does not warn about destructive actions, privacy exposure, or sensitive data handling. In this context, omission of these warnings makes misuse more likely because the skill spans multiple enterprise data domains and high-impact administrative actions.

Session Persistence

Medium

• Category: Rogue Agent

Content

npm install -g @larksuiteoapi/lark-mcp
```

### 2. Create a Feishu/Lark app
1. Go to [Feishu Open Platform](https://open.feishu.cn/app) (or [Lark Open Platform](https://open.larksuite.com/app) for international)
2. Create a new custom app
3. Copy your **App ID** and **App Secret**

• Confidence: 74% confidence
• Finding: The setup flow encourages creation and use of persistent App ID/App Secret credentials for a broadly capable integration, but the README does not discuss secure storage, rotation, scoping, or ephemeral alternatives. In this skill context, long-lived credentials are particularly risky because they can unlock messaging, drive, meetings, approvals, and transcript access across the workspace if mishandled.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The README instructs users to execute an unpinned package directly via npx, which fetches the latest published version at runtime. If the upstream package is compromised, typosquatted, or a malicious release is pushed, users may execute attacker-controlled code with access to Lark credentials and local environment secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: This command uses `npx -y` with an unversioned package, causing execution of whatever version is current in the registry at the moment the user runs it. Because this flow handles App ID/App Secret login, a compromised release could steal secrets or obtain persistent access to the tenant.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: Running the server from an unpinned `npx` reference creates a supply-chain execution risk, especially because the server will process privileged Lark API actions and may receive app secrets. In this skill context, compromise is more dangerous because the tool can access messaging, files, calendars, meeting recordings, and other sensitive enterprise data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The extended command for video conferencing and minutes APIs also uses an unpinned `npx` package, adding the same supply-chain risk while enabling especially sensitive scopes like recordings and transcripts. A malicious package version could exfiltrate highly sensitive meeting content and metadata at scale.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Copy `SKILL.md` into your OpenClaw skills directory:
```bash
# Workspace-level (takes precedence)
cp SKILL.md <your-openclaw-workspace>/skills/feishu-lark/SKILL.md

# Or shared across all agents
cp SKILL.md ~/.openclaw/skills/feishu-lark/SKILL.md

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

Copy `SKILL.md` into your OpenClaw skills directory:
```bash
# Workspace-level (takes precedence)
cp SKILL.md <your-openclaw-workspace>/skills/feishu-lark/SKILL.md

# Or shared across all agents
cp SKILL.md ~/.openclaw/skills/feishu-lark/SKILL.md

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The usage guidance tells users to 'just talk to your OpenClaw agent naturally' and then demonstrates broad, high-impact actions without any trigger constraints, confirmation requirements, or least-privilege boundaries. In an agentic environment, this increases the chance of unintended execution of destructive or privacy-invasive operations from ambiguous prompts, prompt injection, or user misunderstanding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs users to execute an unpinned npm package via `npx -y @larksuiteoapi/lark-mcp`, which fetches the latest published package at runtime. If the upstream package is compromised, typo-squatted, or a breaking/malicious release is published, users could execute attacker-controlled code with access to Lark app credentials and local environment secrets.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This line again recommends running the MCP package through `npx` without an exact version pin, creating a software supply-chain risk. Because the command includes `-a <APP_ID> -s <APP_SECRET>`, any malicious or compromised package version could immediately capture or misuse high-value credentials.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill strongly encourages `useUAT: true` for interactive operations without warning that this enables access to user-owned messages, documents, calendar data, contacts, recordings, and minutes transcripts. In this context, the absence of privacy and consent guidance increases the risk of oversharing, unauthorized data access, and inadvertent collection of sensitive enterprise communications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents destructive actions such as deleting messages, disbanding chats, deleting tables, records, files, tasks, reservations, and approvals, but it provides no confirmation, backup, or safety guidance. In an agent setting, omission of guardrails can turn ordinary operational capabilities into accidental destructive actions against production collaboration data.

Session Persistence

Medium

• Category: Rogue Agent

Content

useUAT: true
```

### Add Task to a Task List
**Tool**: `mcp__lark-mcp__task.v2.task.addTasklist`
```yaml
path:

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The troubleshooting guidance repeats the unpinned `npx` invocation, reinforcing unsafe operational practice and normalizing execution of whatever version is current in the npm registry. In this skill, that risk is amplified because the tool is intended to access messaging, documents, drive, calendar, approvals, recordings, and other sensitive enterprise data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This login command also uses an unpinned npm package, exposing users to arbitrary code execution during authentication/token refresh flows. Since login may issue user access tokens and refresh tokens, compromise here could lead to persistent unauthorized access to the user's Lark environment.

Static analysis

No suspicious patterns detected.