lark-whiteboard
The skill executes unverified global dependencies and relies on external, mutable configuration files, creating an insecure, opaque supply chain that lacks transparency and integrity controls.
Skill Info
Install
npx skills add https://github.com/larksuite/cliAssessments (3)
AI Agent Traps ↗Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
npx -y
The skill forces the agent to read authentication and permission logic from a separate, external skill directory (`../lark-shared/SKILL.md`). This creates a hidden dependency chain where the security posture of this skill is entirely reliant on the integrity of an external, potentially mutable file. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
SKILL.md links to "references/lark-whiteboard-query.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[`+query --output_as image/svg`](references/lark-whiteboard-query.md)
SKILL.md links to "references/lark-whiteboard-update.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[`+update --input_format mermaid/plantuml/svg`](references/lark-whiteboard-update.md)
SKILL.md links to "references/lark-whiteboard-workflow.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[§ 创作 Workflow](references/lark-whiteboard-workflow.md#创作-workflow)
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Version History (4)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard)<a href="https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard"><img src="https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow