Lark Report Collector

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:16 PM UTC
• Version: 1.0.0

Overview

The skill matches its Lark report-collection purpose, but it should be reviewed because it handles employee report data and writes it to an unspecified local file without retention or sharing controls.

Install only if you are comfortable granting the agent access to your Lark workplace reports. Before use, confirm the exact team/template/week, the Lark Doc audience, notification recipients, and where any temporary local report file will be stored and deleted.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:44

Finding

Unsecured Local Persistence of Sensitive Lark Report Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 44–50
Vulnerability Type: Plaintext sensitive-data persistence and unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code Snippet

markdown

### Step 4: Extract Submitted Members Data

- Same page may show multiple weeks — only extract rows belonging to target week
- Paginate through all rows for the target week
- **Append to local file after each extraction** (prevents data loss)

Technical Analysis

The Skill instructs the agent to append extracted weekly-report data to a local file after every extraction. Such data may contain confidential business reports, employee identities, and submission information.

The instruction does not define:

• An approved private storage directory
• Owner-only file permissions
• Encryption at rest
• A randomized and collision-resistant filename
• A retention period
• Cleanup on success or failure
• Restrictions against writing into shared or source-controlled directories

Consequently, sensitive records may remain on disk beyond the task's lifetime. An unspecified local path could also expose the data through backups, source-control operations, shared workspaces, permissive filesystem settings, or access by other local processes and users.

The Skill's authenticated access to Lark and its Lark-only network operations are consistent with its declared collection, document-creation, and notification functionality. No non-Lark exfiltration endpoint was identified. The confirmed weakness is the insufficiently controlled local persistence step.

Attack Path

1. A user asks the Skill to collect reports for a team and target week.
2. The agent accesses Lark through the user's authenticated browser session.
3. The agent extracts report contents and employee submission data.
4. Following the Skill's mandatory instruction, it appends each extraction to an unspecified local file.
5. The file remains after the report summary is generated bec ...[truncated 834 chars]

Remediation

View remediation

Remediation Suggestions

1. Process report data in memory and avoid writing it to disk unless persistence is strictly necessary.
2. If temporary persistence is required, use an explicitly approved private temporary directory outside shared workspaces and repositories.
3. Create files atomically with owner-only permissions, such as mode 0600, and use randomized, non-predictable filenames.
4. Store only the minimum fields needed to produce the requested summary.
5. Encrypt temporary data at rest when the execution environment cannot guarantee exclusive access.
6. Delete temporary files immediately after document creation, including cleanup in error, cancellation, and timeout paths.
7. Define and enforce a short retention limit for recoverable intermediate data.
8. Prevent temporary artifacts from entering source control, logs, telemetry, or backups.
9. Obtain explicit user approval before retaining report data beyond the active execution.
10. Restrict collection to the user-requested templates and weeks, and restrict document sharing and notification recipients to those explicitly authorized.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill collects potentially sensitive employee weekly reports and unsubmitted-member data, then instructs creating a Lark Doc and sending notifications via Lark API without any warning, consent check, or guidance on minimizing data exposure. In a workplace reporting context, this can lead to unintended disclosure of personal or confidential team information to the wrong document audience or chat recipients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown skill file instructs the agent to "Append to local file after each extraction," which is a file-write operation. The document does not include a clear warning to the user that the workflow will write local files or modify local data during execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.