lark-whiteboard
飞书画板：查询和编辑飞书云文档中的画板。支持导出画板为预览图片、导出原始节点结构、使用多种格式更新画板内容。 当用户需要查看画板内容、导出画板图片、编辑画板时使用此 skill。不负责：飞书云文档内容编辑（lark-doc）、文档内嵌电子表格/Base（lark-sheets / lark-base）。
67
83%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
画板“创作/编辑”在运行时会把用户输入（如需要创作/更新的 Mermaid/PlantUML/SVG/DSL 源文本或用户指定内容）生成/写入画板，其中 `routes/mermaid.md`/`routes/dsl.md` 明确从 .mmd/.json 源文本生成并通过 `whiteboard +update --input_format ... --source -` 写回。
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill repeatedly runs the external command "npx -y @larksuite/whiteboard-cli@^0.2.13" (e.g., "npx -y @larksuite/whiteboard-cli@^0.2.13 -v"), which fetches and executes remote npm package code at runtime and is required by the workflows, so this is a runtime external dependency that executes remote code.
- Repository
- larksuite/cli
- Commit
6646386
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.