40Medium
The skill lacks documentation for its core functions and introduces security risks by processing potentially malicious external content without adequate validation or defined usage terms.
Skill Info
Namelarksuite/cli/lark-im
Registrygithub
Versionbba13cfe0f09
PURLpkg:github/larksuite/cli@bba13cfe0f09?skill=lark-im
Stars14,414
Installs251,700
Source
Install
This skill has findings worth reviewing before installing.
GitHub
251,400 installs
Skills.shDocs
npx skills add https://github.com/larksuite/cliAssessments (2)
AI Agent Traps ↗Potential for indirect prompt injectionmediumindirect prompt injection
The skill supports downloading and processing external message content and files, which could contain malicious payloads that the agent might execute or follow if the content is treated as instructions.
70% confidenceline 56
Opt-in resource auto-download (`--download-resources`)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-im-chat-create.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+chat-create`](references/lark-im-chat-create.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-im-chat-list.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+chat-list`](references/lark-im-chat-list.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-im-chat-messages-list.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+chat-messages-list`](references/lark-im-chat-messages-list.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-im-message-enrichment.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`references/lark-im-message-enrichment.md`](references/lark-im-message-enrichment.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-im-messages-resources-download.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+messages-resources-download`](references/lark-im-messages-resources-download.md)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-im)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-im"><img src="https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-im.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-im.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow