技能 lark-openapi-explorer
📦
lark-openapi-explorer
v1.0.0 内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
探索 Lark OpenAPI 端点
团队经常需要执行现有技能未封装的 Lark API 操作。此技能可查找官方端点详情，并帮助通过 lark-cli 调用它们。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "lark-openapi-explorer" from https://skillstore.io/skills/larksuite-lark-openapi-explorer.md and its manifest at https://skillstore.io/api/skills/larksuite-lark-openapi-explorer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“lark-openapi-explorer”。 查找在没有封装命令时如何将用户添加到 Lark 聊天。
预期结果:
该技能会识别聊天成员端点，列出必需标识符和权限，并在添加成员前请求确认。
正在使用“lark-openapi-explorer”。 用英语解释更新聊天公告的 API。
预期结果:
该技能会总结端点用途、必需的 revision 值、公告内容格式、权限和预期响应行为。
正在使用“lark-openapi-explorer”。 检查现有命令是否可以处理消息任务。
预期结果:
该技能会先查看可用的 lark-cli 消息命令，仅在没有直接命令时才使用 OpenAPI 文档。
安全审计
高风险v7 • 2026/7/9 打开版本化报告
Most static backtick detections are Markdown formatting false positives, but several entries describe real lark-cli command workflows. The skill also relies on official Feishu and Lark documentation fetches and contains out-of-package sibling skill references. No prompt-injection attempt was found in SKILL.md.
1
已扫描文件
154
分析行数
15
复核项
0
已忽略误报
已确认安全问题 (1)
高
Authenticated Lark API Mutation Capability
The skill instructs agents to call raw Lark OpenAPI POST, PUT, PATCH, and DELETE operations through lark-cli. Misuse could alter chats, members, announcements, or other tenant resources under the authenticated account.
The file explicitly lists mutating HTTP methods and examples that modify chat members and announcements. Built-in confirmation guidance reduces abuse risk but does not remove the capability.
能力复核项 (15)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Path traversal sequence
> **前置条件:** 先阅读 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md) 了解认证、身份切换和安全规则。
The skill asks the agent to read ../lark-shared/SKILL.md outside this skill directory. That crosses the package boundary even if the intended target is a sibling Lark skill.
高
Path traversal sequence
- [lark-shared](../lark-shared/SKILL.md) — 认证和全局参数
The Markdown link points to a sibling skill using ../ outside this package. It appears to be a repository reference, but it can still drive out-of-package file reads.
高
Path traversal sequence
- [lark-skill-maker](../lark-skill-maker/SKILL.md) — 如需将挖掘到的 API 固化为新 Skill
The Markdown link points to a sibling skill using ../ outside this package. It appears to be a repository reference, but it can still drive out-of-package file reads.
中
Ruby/shell backtick execution
当用户的需求**无法被现有 skill 或 CLI 已注册 API 覆盖**时,使用本技能从飞书官方 markdown 文档库中逐层挖掘原生 OpenAPI 接口,然后通过 `lark-cli api
The text directs the agent to use lark-cli commands with local authentication. Those commands can reach Lark APIs and may read or change workspace data.
中
Ruby/shell backtick execution
```bash
The block includes a lark-cli command invocation. It is a read-only help check, but it still depends on executing an external binary.
中
Ruby/shell backtick execution
使用 `lark-cli api` 裸调:
The text directs the agent to use lark-cli commands with local authentication. Those commands can reach Lark APIs and may read or change workspace data.
中
Ruby/shell backtick execution
```bash
The text directs the agent to use lark-cli commands with local authentication. Those commands can reach Lark APIs and may read or change workspace data.
中
Ruby/shell backtick execution
5. **调用示例**:给出 `lark-cli api` 的完整命令
The text asks the agent to provide a complete lark-cli api command. This is command generation rather than direct execution, but it supports the authenticated command workflow.
中
Ruby/shell backtick execution
```bash
The example contains a concrete lark-cli api mutation against Lark resources. It can affect tenant data if run with authenticated credentials.
中
Ruby/shell backtick execution
```bash
The example contains a concrete lark-cli api mutation against Lark resources. It can affect tenant data if run with authenticated credentials.
低
Hardcoded URL
| 飞书 (Feishu) | `https://open.feishu.cn/llms.txt` |
The skill instructs fetching external official Feishu or Lark documentation. The domains are expected for the skill, but network access is a real dependency.
低
Hardcoded URL
| Lark | `https://open.larksuite.com/llms.txt` |
The skill instructs fetching external official Feishu or Lark documentation. The domains are expected for the skill, but network access is a real dependency.
低
Hardcoded URL
WebFetch https://open.feishu.cn/llms.txt
The skill instructs fetching external official Feishu or Lark documentation. The domains are expected for the skill, but network access is a real dependency.
低
Hardcoded URL
WebFetch https://open.feishu.cn/llms-docs/zh-CN/llms-<module>.txt
The skill instructs fetching external official Feishu or Lark documentation. The domains are expected for the skill, but network access is a real dependency.
低
Hardcoded URL
WebFetch https://open.feishu.cn/document/server-docs/.../<api>.md
The skill instructs fetching external official Feishu or Lark documentation. The domains are expected for the skill, but network access is a real dependency.
风险因素
⚙️ 外部命令 (25)
SKILL.md:12 SKILL.md:14 SKILL.md:20-24 SKILL.md:24-30 SKILL.md:30-31 SKILL.md:31-41 SKILL.md:41-44 SKILL.md:44-52 SKILL.md:52-55 SKILL.md:55-57 SKILL.md:57-58 SKILL.md:58-65 SKILL.md:65-68 SKILL.md:68-74 SKILL.md:74-77 SKILL.md:77-81 SKILL.md:81-83 SKILL.md:83-95 SKILL.md:95-102 SKILL.md:102-105 SKILL.md:105-113 SKILL.md:113-121 SKILL.md:121-133 SKILL.md:133-137 SKILL.md:137-148
🌐 网络访问 (5)
📁 文件系统访问 (4)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/larksuite-lark-openapi-explorer/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/larksuite-lark-openapi-explorer?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/larksuite-lark-openapi-explorer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/larksuite-lark-openapi-explorer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/larksuite-lark-openapi-explorer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
larksuite. (2026). lark-openapi-explorer security audit report (audit version 7) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/larksuite-lark-openapi-explorer/audits/7BibTeX 引用
@techreport{larksuite-larksuite-lark-openapi-explorer-2026,
author = {larksuite},
title = {lark-openapi-explorer security audit report (audit version 7)},
institution = {Skillstore},
year = {2026},
number = {7},
url = {https://skillstore.io/skills/larksuite-lark-openapi-explorer/audits/7},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lark-openapi-explorer security audit report (audit version 7)"
version: "1.0.0"
type: report
authors:
- name: "larksuite"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/larksuite-lark-openapi-explorer/audits/7"
identifiers:
- type: other
value: "skillstore:larksuite-lark-openapi-explorer:audit:7"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 高 55
架构
100
可维护性
87
内容
68
社区
91
规范符合性
你能构建什么
查找未封装的聊天 API
定位 lark-cli 未直接公开的聊天操作官方端点。
准备 API 调用计划
在运行敏感 Lark 操作之前，收集必需参数、权限范围和请求约束。
翻译 API 文档
将中文 Feishu OpenAPI 文档转换为简洁的英文实现说明。
试试这些提示
查找 Lark 端点
查找此任务的官方 Lark OpenAPI 端点：[describe task]。先检查现有 lark-cli 覆盖范围。
总结必需输入
使用官方 Feishu 文档列出 [task] 的方法、路径、必需参数、权限和关键错误。
准备安全调用
为 [task] 准备 lark-cli api 调用。在任何写入、更新或删除操作前请求确认。
比较候选 API
在 Lark OpenAPI 文档中搜索与 [workflow] 相关的 API。比较候选项并推荐最安全的端点。
最佳实践
- 在探索原始 OpenAPI 端点之前，先从现有 lark-cli help 开始。
- 将官方 Feishu 或 Lark 文档作为每个参数的可信来源。
- 在运行变更调用之前，确认目标资源、权限范围和预期影响。
避免
- 不要凭记忆猜测 API 路径或请求体。
- 没有明确确认时，不要运行 POST、PUT、PATCH 或 DELETE 操作。
- 不要使用非官方 API 文档链接进行端点发现。
常见问题
此技能解决什么问题？
当现有技能或 lark-cli 命令无法覆盖某个任务时，它会帮助查找原生 Lark OpenAPI 端点。
它是否需要 lark-cli？
是。该技能设计为在发现端点后通过 lark-cli api 调用端点。
它能在 Lark 工作区中进行更改吗？
可以，前提是用户确认写入操作，并且已认证账号具备所需权限。
它使用哪些文档来源？
它使用官方 Feishu 和 Lark OpenAPI 文档索引及端点页面。
英语用户可以使用它吗？
可以。该技能会指示助手在需要时将中文文档详情翻译成英语。
它能替代官方 API 审查吗？
不可以。用户在执行前仍应验证权限、目标标识符和操作影响。