lark-drive
Warn
Audited by Snyk on Apr 13, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly accepts and resolves arbitrary Feishu document and wiki URLs and calls locate-doc/docs +fetch and drive file.comments list (see SKILL.md and references/lark-drive-add-comment.md / lark-drive-download.md), meaning it fetches and interprets user-generated document and comment content as part of its workflow which can materially influence actions like where/how to add comments or replies.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata