lark-whiteboard
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
lark-clito manage documents and whiteboards within the Lark platform. It also executesnpxcommands to run the@larksuite/whiteboard-cliutility for rendering and format conversion. It includes instructions for users to perform system maintenance usingnpx skills remove. - [DYNAMIC_EXECUTION]: To create complex visuals such as fishbone or treemap charts, the skill generates and runs local CommonJS (
.cjs) scripts with Node.js. These scripts perform the mathematical calculations required for precise coordinate placement and output the resulting data in JSON format. - [EXTERNAL_DOWNLOADS]: The skill provides procedures to download images from external URLs using
curl. These images are intended to be uploaded to the Lark ecosystem as media tokens for inclusion in whiteboard diagrams. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (such as labels, categories, and image URLs) to populate diagram templates and layout scripts, which represents an attack surface for processing untrusted content.
Audit Metadata