The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains instructions explicitly telling the agent to run tools such as lark-cli and npx without asking the user ('无需询问用户'). This is a pattern used to bypass standard user confirmation protocols for tool execution.
[DYNAMIC_EXECUTION]: Multiple scene files (e.g., scenes/fishbone.md, scenes/bar-chart.md, scenes/flywheel.md, scenes/funnel.md, scenes/pyramid.md, scenes/treemap.md) instruct the agent to generate a JavaScript file (diagram.gen.cjs) containing logic and user-provided data, and then execute it using the node command. This pattern of generating and executing local scripts is a high-risk dynamic execution vector.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted user data and interpolating it into executable scripts.
Ingestion points: User-supplied diagram content (labels, values, titles) processed in scenes/ templates.
Boundary markers: No explicit delimiters or instructions are used to isolate user data within the generated scripts.
Capability inventory: The agent has the capability to execute node on generated files and use lark-cli to perform network operations (Lark API updates).
Sanitization: The provided JavaScript templates use direct string interpolation for user-controlled values without visible sanitization or escaping logic.
[EXTERNAL_DOWNLOADS]: The skill workflow frequently invokes npx -y @larksuite/whiteboard-cli@^0.2.13 to download and execute code from the Lark Suite official NPM organization. While the source is a well-known vendor, the practice of automated external code execution is documented here as part of the tool's operation.

lark-whiteboard