Back to skill
Skillv0.1.0
ClawScan security
Lark Work Report · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 6:30 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent: it is an instruction-only Lark/Feishu reporting helper that uses MCP chat/list/create/message interfaces and does not request extra credentials or install code.
- Guidance
- This is an instruction-only Lark/Feishu reporting helper and appears coherent. Before enabling: (1) confirm your agent's lark-mcp integration has only the permissions you want (message send, chat create, user lookup) and review any audit logs for actions; (2) be prepared to provide identity details (email/mobile/open_id) when asked — these are required only to resolve or invite the user and are not stored by the skill itself; (3) note that the skill can be invoked autonomously by the agent (platform default) but the SKILL.md requires user confirmation before creating or switching groups — if you want to be extra safe, restrict autonomous invocation or require explicit user prompts in your agent settings; (4) the package has no external install or code, so risk is limited to what the MCP integration can do.
Review Dimensions
- Purpose & Capability
- okName/description match the instructions: the SKILL.md only describes finding/creating a work group and sending concise reports via the Lark MCP APIs, which is exactly what a Lark reporting skill would need.
- Instruction Scope
- noteInstructions are narrowly scoped to discovering/creating a reporting chat and sending a test + final report. It explicitly requires user confirmation before sending and documents non-goals (no polling, no monitoring). Note: the runtime will ask for user identity details (name/mobile/email/open_id) when it must resolve or create group membership — this is expected but is personal data the user should approve providing.
- Install Mechanism
- okNo install spec and no code files — instruction-only skill. Lower risk because nothing is written to disk. The package references an MCP dependency in agents/openai.yaml (lark-mcp), which is expected for MCP-based integrations.
- Credentials
- okThe skill declares no required env vars or credentials. It relies on the platform's MCP tool (lark-mcp) to provide authenticated access to Feishu/Lark APIs; that is proportionate to the stated purpose. Users should verify that the MCP/tool has only the permissions they expect (send messages, create chats, lookup users).
- Persistence & Privilege
- okalways is false and the skill does not request persistent system-level presence or modify other skill configs. Autonomous invocation is allowed (platform default) but the skill's instructions emphasize explicit user confirmation before switching or creating groups.