skills/aahl/skills/mcp-lark/Socket

mcp-lark

Warn

Audited by Socket on Sep 14, 2026

1 alert found:

Anomaly

AnomalySKILL.md

LOW

AnomalyLOW

SKILL.md

SUSPICIOUS: the purpose and official Lark data flow are broadly coherent, but the skill unnecessarily relies on a third-party unpinned CLI (`mcporter`) instead of Lark's official package and asks the agent to collect/store MCP URLs in `.env`. This is more a supply-chain and credential-forwarding concern than confirmed malware.

Confidence: 89%Severity: 59%

Audit Metadata

Analyzed At

Sep 14, 2026, 07:12 PM

Package URL

pkg:socket/skills-sh/aahl%2Fskills%2Fmcp-lark%2F@cc2e95ca9215cb8d002bb3cee651857938eb8c39de69fcfb9f044f4dbb22627c