40Medium
The skill executes unverified global dependencies and relies on external, mutable configuration files, creating an insecure, opaque supply chain that lacks transparency and integrity controls.
Skill Info
Namelarksuite/cli/lark-whiteboard
Registrygithub
Version775ee5a501f0
PURLpkg:github/larksuite/cli@775ee5a501f0?skill=lark-whiteboard
Stars14,896
Installs291,200
Source
Install
This skill has findings worth reviewing before installing.
GitHub
291,200 installs
Skills.shDocs
npx skills add https://github.com/larksuite/cliAssessments (3)
AI Agent Traps ↗Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinningmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
95% confidenceline 15
npx -y
Cross-skill credential dependencymediumcredential theftAML.T0055AML.T0037LLM02:2025
The skill forces the agent to read authentication and permission logic from a separate, external skill directory (`../lark-shared/SKILL.md`). This creates a hidden dependency chain where the security posture of this skill is entirely reliant on the integrity of an external, potentially mutable file. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
80% confidenceline 17
CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理
Missing usage exampleslowpolicy violation
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
100% confidence
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-query.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+query --output_as image/svg`](references/lark-whiteboard-query.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-update.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+update --input_format mermaid/plantuml/svg`](references/lark-whiteboard-update.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-workflow.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[§ 创作 Workflow](references/lark-whiteboard-workflow.md#创作-workflow)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (4)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard"><img src="https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow