lark-whiteboard

40Medium

The skill executes unverified global dependencies and relies on missing external documentation, creating significant supply chain risks and preventing transparent evaluation of its operational behavior.

Threat Analysis

AI Agent Traps ↗Scanned 6/30/2026
Content InjectionPerceptionclean
Semantic ManipulationReasoningclean
Cognitive StateMemory & Learning1 finding
SystemicMulti-Agent Dynamicsclean
Human-in-the-LoopHuman Overseerclean
HygienePackaging & Manifest5 findings

Skill Info

Namelarksuite/cli/lark-whiteboard
Registrygithub
Version22108c3300a2
PURLpkg:github/larksuite/cli@22108c3300a2?skill=lark-whiteboard
Stars14,876
Installs288,800

Install

This skill has findings worth reviewing before installing.
GitHub
GitHub
288,800 installs
Skills.sh
Skills.shDocs
npx skills add https://github.com/larksuite/cli

Assessments (2)

AI Agent Traps ↗
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinningmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025

Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning

95% confidenceline 15
npx -y
Missing usage exampleslowpolicy violation

Skill body contains no code blocks or usage examples, making it harder for users to evaluate.

100% confidence
Referenced file missing from skill packagelowpolicy violation

SKILL.md links to "references/lark-whiteboard-query.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

90% confidence
[`+query --output_as image/svg`](references/lark-whiteboard-query.md)
Referenced file missing from skill packagelowpolicy violation

SKILL.md links to "references/lark-whiteboard-update.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

90% confidence
[`+update --input_format mermaid/plantuml/svg`](references/lark-whiteboard-update.md)
Referenced file missing from skill packagelowpolicy violation

SKILL.md links to "references/lark-whiteboard-workflow.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime

90% confidence
[§ 创作 Workflow](references/lark-whiteboard-workflow.md#创作-workflow)
Missing licenseinfopolicy violation

Skill does not specify a license field. Specifying a license helps users understand usage terms.

100% confidence

Badge

Skill Check badge
Markdown
[![Mondoo Skill Check](https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svg)](https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard)
HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard"><img src="https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svg" alt="Mondoo Skill Check" /></a>
Image URL
https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svg

Secure your AI agents

Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.

  • Continuous scanning of skills across all registries
  • Policy enforcement before skills reach your agents
  • Integration with your existing security workflow

By submitting, you agree to our privacy policy.