lark-whiteboard
The skill executes unverified global dependencies and relies on external, non-packaged configuration files, creating a centralized security risk through insecure, unpinned, and opaque authentication and workflow logic.
Skill Info
Install
npx skills add https://github.com/larksuite/cliAssessments (3)
AI Agent Traps ↗Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
npx -y
The skill forces the agent to read authentication and permission logic from a separate, external skill directory (`../lark-shared/SKILL.md`). This creates a centralized point of failure where a compromised shared component could inject malicious auth-handling instructions into all dependent skills. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理
The instructions explicitly command the agent to perform environment checks (version verification) without user confirmation or oversight, bypassing standard safety checks for tool availability.
确认可用，无需询问用户。
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
SKILL.md links to "references/lark-whiteboard-query.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[`+query --output_as image/svg`](references/lark-whiteboard-query.md)
SKILL.md links to "references/lark-whiteboard-update.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[`+update --input_format mermaid/plantuml/svg`](references/lark-whiteboard-update.md)
SKILL.md links to "references/lark-whiteboard-workflow.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
[§ 创作 Workflow](references/lark-whiteboard-workflow.md#创作-workflow)
Skill does not specify a license field. Specifying a license helps users understand usage terms.
Version History (4)
Badge
[](https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard)<a href="https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard"><img src="https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow