sheets

SUSPICIOUS: The skill’s stated purpose and requested permissions are coherent for reading Lark spreadsheets, and data flow appears aimed at official Lark services. However, the core dependency is an unverifiable bundled binary (`tools/bin/lark`) with no source or integrity evidence in the skill, which materially elevates supply-chain risk even without signs of overt malware.