The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the agent to generate local JavaScript files (e.g., diagram.gen.js) and execute them using node. This is done to calculate the math for complex diagram layouts like fishbone or flywheel charts. It also executes various shell commands using lark-cli and npx to interact with the Lark API.
[REMOTE_CODE_EXECUTION]: The skill uses npx to download and execute the @larksuite/whiteboard-cli package from the NPM registry at runtime. This tool handles the rendering and icon fetching for the diagrams.
[DATA_EXFILTRATION]: The skill handles sensitive Lark authentication tokens. It includes a mandatory safety check (dry run) that requires user confirmation before the agent can overwrite existing whiteboard content, which mitigates the risk of accidental data loss.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. Ingestion points: Data fetched from external Lark documents via lark-cli docs +fetch. Boundary markers: None. Capability inventory: Execution of shell commands and local scripts. Sanitization: None; the skill does not specify how to handle potentially malicious instructions embedded in the processed documents.

lark-whiteboard-cli