The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands to invoke lark-cli, which is used for slide management tasks such as creation, reading XML, and uploading media. These commands are integral to the skill's functionality and target the Lark/Feishu platform.
[EXTERNAL_DOWNLOADS]: Instructions specify the installation of the @larksuite/cli package from npm, an official package from a well-known service provider. The skill also facilitates the download of images from the Lark platform for local processing, which is consistent with its stated purpose.
[DYNAMIC_EXECUTION]: The scripts xml_text_overlap_lint_test.py and iconpark_tool_test.py use os.execv and subprocess.run respectively. These calls are confined to executing other local Python scripts within the skill's own package for the purpose of internal utility testing and validation.
[INDIRECT_PROMPT_INJECTION]: The skill consumes XML data from external Lark presentations via the +xml-get command. This represents an attack surface where untrusted data enters the agent context. The skill mitigates this risk by employing a structured validation script (xml_lint.py) and requiring human review of rendered screenshots before final delivery.

lark-slides