40Medium
The skill executes unverified global dependencies and relies on missing external documentation, creating significant supply chain risks and preventing transparent evaluation of its operational behavior.
Skill Info
Namelarksuite/cli/lark-whiteboard
Registrygithub
Version22108c3300a2
PURLpkg:github/larksuite/cli@22108c3300a2?skill=lark-whiteboard
Stars14,876
Installs288,800
Source
Install
This skill has findings worth reviewing before installing.
GitHub
288,800 installs
Skills.shDocs
npx skills add https://github.com/larksuite/cliAssessments (2)
AI Agent Traps ↗Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinningmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
95% confidenceline 15
npx -y
Missing usage exampleslowpolicy violation
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
100% confidence
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-query.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+query --output_as image/svg`](references/lark-whiteboard-query.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-update.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+update --input_format mermaid/plantuml/svg`](references/lark-whiteboard-update.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-workflow.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[§ 创作 Workflow](references/lark-whiteboard-workflow.md#创作-workflow)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (4)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard"><img src="https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow