40Medium
The skill executes unverified global dependencies and relies on external, non-packaged configuration files, creating a centralized security risk through insecure, unpinned, and opaque authentication and workflow logic.
Skill Info
Namelarksuite/cli/lark-whiteboard
Registrygithub
Versioncccf025599d9
PURLpkg:github/larksuite/cli@cccf025599d9?skill=lark-whiteboard
Stars15,038
Installs301,500
Source
Install
This skill has findings worth reviewing before installing.
GitHub
301,500 installs
Skills.shDocs
npx skills add https://github.com/larksuite/cliAssessments (3)
AI Agent Traps ↗Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinningmediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025
Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning
95% confidenceline 15
npx -y
Cross-Skill Credential Dependencymediumcredential theftAML.T0055AML.T0037LLM02:2025
The skill forces the agent to read authentication and permission logic from a separate, external skill directory (`../lark-shared/SKILL.md`). This creates a centralized point of failure where a compromised shared component could inject malicious auth-handling instructions into all dependent skills. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]
80% confidenceline 17
CRITICAL — 开始前 MUST 先用 Read 工具读取 [`../lark-shared/SKILL.md`](../lark-shared/SKILL.md)，其中包含认证、权限处理
Forced silent executionlowoversight evasionAML.T0054LLM01:2025LLM07:2025
The instructions explicitly command the agent to perform environment checks (version verification) without user confirmation or oversight, bypassing standard safety checks for tool availability.
90% confidenceline 14
确认可用，无需询问用户。
Missing usage exampleslowpolicy violation
Skill body contains no code blocks or usage examples, making it harder for users to evaluate.
100% confidence
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-query.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+query --output_as image/svg`](references/lark-whiteboard-query.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-update.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[`+update --input_format mermaid/plantuml/svg`](references/lark-whiteboard-update.md)
Referenced file missing from skill packagelowpolicy violation
SKILL.md links to "references/lark-whiteboard-workflow.md" but the file is not part of the skill package — the workflow silently degrades or the content is sourced elsewhere at runtime
90% confidence
[§ 创作 Workflow](references/lark-whiteboard-workflow.md#创作-workflow)
Missing licenseinfopolicy violation
Skill does not specify a license field. Specifying a license helps users understand usage terms.
100% confidence
Version History (4)
Badge
Markdown
[](https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard)HTML
<a href="https://mondoo.com/ai-agent-security/skills/github/larksuite/cli/lark-whiteboard"><img src="https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svg" alt="Mondoo Skill Check" /></a>Image URL
https://mondoo.com/ai-agent-security/api/badge/github/larksuite/cli/lark-whiteboard.svgSecure your AI agents
Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.
- Continuous scanning of skills across all registries
- Policy enforcement before skills reach your agents
- Integration with your existing security workflow