lark-vc

SAFE max severity LOWSkillSpector Caution 0 registry open.feishu.cn last scanned 1 scan

Verdict safe, but 4 findings (3 low, 1 info), mainly obfuscation, social engineering, policy violation. Most recent scan 2026-10-22.

Findings4
Critical0
High0
Medium0
Low3
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 0
Score0 / 100
Issues0
Version2.12.0 (static)

SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

The skill's SKILL.md has no description field.

Package
2 files, 7.9 KB
SKILL.md
516 words
Code
None. Instructions only.

Findings

LOW Hidden data file detected Obfuscationstatic

Hidden file found: .wellknown-origin.json. Hidden files may contain concealed configuration or data that should be reviewed.

.wellknown-origin.json

Remediation: Move file to a visible location or document its purpose.
LOW File extension does not match actual content type Obfuscationstatic

Markdown file 'SKILL.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.

SKILL.md

Remediation: Rename the file to match its actual content type, or remove it if it appears malicious.
LOW Skill description is too short Social Engineeringtrigger

Description has only 3 words. Short descriptions may not provide enough context for the agent to determine when this skill should be used.

SKILL.md

Remediation: Expand the description to at least 10-20 words explaining the skill's purpose, capabilities, and appropriate use cases.
INFO Strict manifest load failed; inert fallback scan used Policy Violationskill_loader

SkillLoadError rejected malformed or missing manifest metadata. The bounded package body was still scanned as inert content; manifest capabilities were not trusted.

SKILL.md

Remediation: Repair the YAML frontmatter and provide the required manifest fields.

What is in the package

FileKindSize
.wellknown-origin.jsonconfig379 B
SKILL.mddoc7.5 KB

External hosts referenced

open.feishu.cn

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills