feishu-lark
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements messaging functionality for Feishu and Lark using official API endpoints (open.feishu.cn and open.larksuite.com). All communication is directed to these well-known services.
- [SAFE]: Credential management follows best practices by using environment variables (e.g., FEISHU_WEBHOOK_URL, FEISHU_APP_SECRET) rather than hardcoded secrets. The skill includes safe checks for the presence of these variables without revealing their contents.
- [SAFE]: The skill explicitly instructs the agent to 'Never auto-send without explicit user confirmation', providing a strong human-in-the-loop safeguard against accidental or malicious message dispatch.
- [SAFE]: Command execution is limited to standard system utilities (curl, openssl) and local Python 3 scripts used for JSON processing and HMAC-SHA256 signature calculation, which are appropriate for the stated purpose.
Audit Metadata