Skills lark-okr

📦

lark-okr

Name: lark-okr
Author: larksuite

v1.0.0 Content revision r2 Medium Risk 📁 Filesystem access🌐 Network access⚙️ External commands

Manage Lark OKRs with AI

Lark OKR administration requires many specialized commands and data formats. This skill guides Claude, Codex, and Claude Code through common OKR workflows.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "lark-okr" from https://skillstore.io/skills/larksuite-lark-okr.md and its manifest at https://skillstore.io/api/skills/larksuite-lark-okr/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/larksuite-lark-okr.md Signed manifest GET /api/skills/larksuite-lark-okr/manifest Signed lockfile GET /api/skills/larksuite-lark-okr/lockfile

Test it

Using "lark-okr". Show my OKR cycles for the first half of 2026.

Expected outcome:

H1 2026: January 1 through June 30, active.
Q1 2026: January 1 through March 31, completed.

Using "lark-okr". Summarize cycle 7000000000000000001.

Expected outcome:

The cycle contains three objectives and eight key results. Two indicators need updates, and one deadline is overdue.

Using "lark-okr". Prepare two objectives with two key results each.

Expected outcome:

Preview ready for four new records in the selected cycle. No changes were executed pending approval.

Security Audit

Medium Risk

v5 • 7/23/2026 Open versioned report

Most static alerts are syntax collisions from Markdown, Chinese prose, and OKR identifiers. One documented lark-cli command performs a remote write, while unbundled security rules and missing confirmation gates create two additional medium risks.

Files scanned

2,456

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Medium

SKILL.md:13

Unbundled Security Instruction Dependency

The skill makes authentication and permission handling depend on a sibling lark-shared file outside this audited package.

Line 13 explicitly requires the sibling file, while the audited file structure does not include it.

Medium

SKILL.md:27-35 SKILL.md:81-99 references/lark-okr-progress-delete.md:5-31 references/lark-okr-alignments.md:117-142

Remote Mutations Lack Mandatory Confirmation

The skill supports irreversible OKR deletions and broad writes. It recommends verification but does not require explicit user confirmation before execution.

The cited workflows directly execute write and irreversible delete commands, but none mandates an approval step.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:64-66

Ruby/shell backtick execution

``` bash

Lines 64-66 contain a real lark-cli command that writes objective weights to Lark. Execution has intended remote side effects.

Risk Factors

📁 Filesystem access (44)

🌐 Network access (7)

references/lark-okr-contentblock.md:52 references/lark-okr-contentblock.md:60 references/lark-okr-contentblock.md:79 references/lark-okr-contentblock.md:242 references/lark-okr-contentblock.md:246 references/lark-okr-contentblock.md:418 references/lark-okr-image-upload.md:46

⚙️ External commands (47)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/larksuite-lark-okr/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/larksuite-lark-okr/security.svg)](https://skillstore.io/skills/larksuite-lark-okr?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/larksuite-lark-okr?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/larksuite-lark-okr/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/larksuite-lark-okr.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

larksuite. (2026). lark-okr security audit report (audit version 5) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/larksuite-lark-okr/audits/5

BibTeX citation

@techreport{larksuite-larksuite-lark-okr-2026,
  author = {larksuite},
  title = {lark-okr security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/larksuite-lark-okr/audits/5},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lark-okr security audit report (audit version 5)"
version: "1.0.0"
type: report
authors:
  - name: "larksuite"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/larksuite-lark-okr/audits/5"
identifiers:
  - type: other
    value: "skillstore:larksuite-lark-okr:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Track personal goals

Review objectives, key results, indicators, and recent progress for a selected cycle.

Coordinate team OKRs

Inspect team cycles, update progress, and manage alignment relationships across authorized objectives.

Maintain OKR structures

Batch-create plans, adjust ordering and weights, and standardize rich content.

Try These Prompts

List OKR cycles

List my Lark OKR cycles for [date range]. Summarize each cycle name, dates, and status without changing data.

Review a cycle

Retrieve cycle [cycle ID]. Summarize objectives, key results, scores, indicators, deadlines, and recent progress.

Create an OKR plan

Preview creating these objectives and key results in cycle [cycle ID]: [plan]. Show proposed changes before execution.

Audit and update progress

Review cycle [cycle ID] and identify stale progress or indicators. Propose updates, then execute only changes I explicitly approve.

Best Practices

Use user identity for personal access. Use bot identity only when required permissions are documented.
Preview writes, verify target IDs, and request confirmation before destructive or batch operations.
Read current records before updates, then report changed fields and affected IDs.

Avoid

Do not guess cycle, objective, key result, alignment, indicator, or progress IDs.
Do not delete records or change weights without explicit approval and a verified target.
Do not use this skill for tasks, calendars, meetings, or performance evaluations.