zhangli 2424d05b01 fix(plugin): harden plugin commands against path traversal, DoS, and agent misuse ...

Security fixes from PR #1596 security audit:
- Skip symlink/hardlink entries during tgz extraction (Zip Slip)
- Limit tgz entry and download size to 10 MB (OOM/DoS)
- Limit error response body read to 4 KB
- Validate MIAODA_APP_TYPE as numeric to prevent path manipulation
- Add validatePluginKey + secureModulePath to block --name path
  traversal (../../.ssh etc.) for install/uninstall

Usability fix:
- Add explicit 'local command, no --app-id' notice in plugin
  reference docs to prevent agent from incorrectly passing
  --app-id to plugin commands (which read package.json locally)

2026-06-30 17:35:13 +08:00

..

lark-approval

feat: sync approval skill for meta api commands (#1499)

2026-06-25 20:40:59 +08:00

lark-apps

fix(plugin): harden plugin commands against path traversal, DoS, and agent misuse

2026-06-30 17:35:13 +08:00

lark-attendance

feat: add attendance user_task.query (#405)

2026-04-11 21:55:05 +08:00

lark-base

feat(base): Add Base URL and title resolve shortcuts (#1338)

2026-06-24 22:26:29 +08:00

lark-calendar

fix: optimize calendar,vc,minutes,note shortcut and skill (#1571)

2026-06-26 12:24:03 +08:00

lark-contact

feat: add contact skill domain guidance (#1144)

2026-06-03 22:32:27 +08:00

lark-doc

fix(docs): hide docs api-version compat flag (#1580)

2026-06-26 14:32:09 +08:00

lark-drive

fix(docs): hide docs api-version compat flag (#1580)

2026-06-26 14:32:09 +08:00

lark-event

feat: support card action trigger (#1528)

2026-06-24 22:00:08 +08:00

lark-im

docs(im): document chat.nickname get/update/delete (#1378)

2026-06-25 17:04:31 +08:00

lark-mail

docs(mail): trim lark-mail skill context (#1527)

2026-06-22 21:32:31 +08:00

lark-markdown

docs(skills): tighten drive and markdown guardrails (#1326)

2026-06-08 19:11:41 +08:00

lark-minutes

fix: optimize calendar,vc,minutes,note shortcut and skill (#1571)

2026-06-26 12:24:03 +08:00

lark-note

fix(docs): hide docs api-version compat flag (#1580)

2026-06-26 14:32:09 +08:00

lark-okr

Improve OKR shortcuts (#1487)

2026-06-18 16:25:23 +08:00

lark-openapi-explorer

feat: open-source lark-cli — the official CLI for Lark/Feishu

2026-03-28 10:36:25 +08:00

lark-shared

docs: optimize lark-drive skill routing (#1284)

2026-06-11 20:19:07 +08:00

lark-sheets

feat(sheets): typed table I/O & error contract, workbook import/export, skill refresh (#1355)

2026-06-25 10:48:13 +08:00

lark-skill-maker

feat: open-source lark-cli — the official CLI for Lark/Feishu

2026-03-28 10:36:25 +08:00

lark-slides

feat(slides):slide screenshot

2026-06-22 13:20:39 +08:00

lark-task

feat: add task event consumer (#1510)

2026-06-24 17:32:02 +08:00

lark-vc

fix(docs): hide docs api-version compat flag (#1580)

2026-06-26 14:32:09 +08:00

lark-vc-agent

fix: optimize calendar,vc,minutes,note shortcut and skill (#1571)

2026-06-26 12:24:03 +08:00

lark-whiteboard

fix(docs): hide docs api-version compat flag (#1580)

2026-06-26 14:32:09 +08:00

lark-wiki

docs(lark-wiki): optimize skill guidance and routing boundaries (#1275)

2026-06-08 11:10:59 +08:00

lark-workflow-meeting-summary

fix(docs): hide docs api-version compat flag (#1580)

2026-06-26 14:32:09 +08:00

lark-workflow-standup-report

docs(task): require --complete=false for pending standup summaries (#1101)

2026-05-26 16:56:40 +08:00