The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill instructs the agent to generate CommonJS (.cjs) scripts based on provided templates to calculate geometric coordinates for complex diagrams such as Fishbone, Flywheel, and Treemaps. These scripts are executed locally using Node.js to produce the final layout JSON.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx to fetch and run the @larksuite/whiteboard-cli package at runtime. This dependency originates from the official organization of a well-known enterprise technology service.
[COMMAND_EXECUTION]: The skill frequently executes shell commands via lark-cli and curl, including operations for downloading external images and piping data between different command-line utilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and image URLs for inclusion in whiteboard diagrams, presenting a surface for indirect prompt injection.
Ingestion points: User prompts providing diagram node text, titles, and image URLs.
Boundary markers: The skill lacks explicit markers or delimiters to separate user data from instructions or to prevent the agent from following embedded commands.
Capability inventory: Shell command execution (lark-cli, curl, npx), file system writes, and local Node.js script execution.
Sanitization: No explicit sanitization, validation, or escaping is performed on user content before it is interpolated into diagram definitions or layout scripts.

lark-whiteboard