feishu-cli-visual
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several visualization libraries, such as ECharts and Three.js, from the well-known jsDelivr content delivery network. These references are standard for web-based data visualization and are handled neutrally within the skill documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided data, including JSON patterns, SVG source, and diagram code, to generate visualizations for document embedding. The scripts implement proper sanitization for HTML outputs, using safe DOM construction methods like
document.createTextNodeand escaping JSON literals to prevent cross-site scripting (XSS) or script tag breakouts. - [COMMAND_EXECUTION]: The skill utilizes local CLI tools and Python scripts to automate document interactions and graphical transformations. These commands are executed using standard argument lists in
subprocess.run, which effectively mitigates shell injection risks. The skill also includes maintenance scripts for scanning documentation and validating design consistency.
Audit Metadata