Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Lark reporting helper, but users should expect it to list chats, send visible test/report messages, and possibly create a work group after confirmation.
Install this only if you want Codex to interact with your Feishu/Lark workspace. Before use, confirm the target group and avoid providing email or mobile details unless needed for group creation; expect test and report messages to be visible to group members.
The documented preflight check goes beyond verifying channel availability by recommending group creation and sending a live test message before task start. This can cause unintended outbound communication or create channels without clear user approval, making the skill capable of side effects prior to the main task.
The skill is scoped as reporting-only, but this playbook expands behavior to creating chat groups and resolving user identities via email or mobile lookup. That broadens the action surface from passive reporting into account/discovery and resource-creation operations, which can lead to unauthorized group creation, privacy exposure, or misuse if triggered without explicit user consent.
The identity-resolution step uses personal contact data such as email or mobile numbers without an explicit privacy notice or minimization guidance. In this skill context, collecting and transmitting personal identifiers increases the risk of privacy violations, unnecessary data exposure, and misuse beyond simple reporting.
The playbook instructs sending a test message but does not warn that this is a visible outbound message to the target chat. In a reporting skill, that omission is risky because operators may assume the check is silent, leading to accidental disclosure, confusion, or unwanted notifications in a real group.
No suspicious patterns detected.
