lark-whiteboard@1.0.0

CAUTION

Publisher claims: "飞书画板：查询和编辑飞书云文档中的画板。支持导出画板为预览图片、导出原始节点结构、使用多种格式更新画板内容。当用户需要查看画板内容、导出画板图片、编辑画板时使用此 skill。不负责：飞书云文档内容编辑（lark-doc）、文档内嵌电子表格/Base（lark-sheets / lark-base）。 " Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher larksuite · joined 2 days agoInstalls 469KLast detonated 41 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packageelements/schema.md:275 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageelements/layout.md:339 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:15 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagescenes/bar-chart.md:11 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/svg.md:40 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/svg.md:35 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/svg.md:37 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/mermaid.md:19 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageelements/schema.md:282 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/svg-edit.md:62 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/dsl.md:16 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/svg-edit.md:59 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/lark-whiteboard-update.md:78 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/lark-whiteboard-update.md:92 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/mermaid.md:22 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/svg.md:36 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/dsl.md:28 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/lark-whiteboard-workflow.md:87 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageroutes/dsl.md:33 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagescenes/line-chart.md:11 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionscenes/mention.md:38 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packagescenes/fishbone.md:13 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionscenes/funnel.md:93 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packagescenes/treemap.md:11 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagescenes/mention.md:38 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

File type combined with upload actionscenes/pyramid.md:85 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

npx invocation of non-well-known packagescenes/flywheel.md:12 · npx invocation of non-well-known package — may execute untrusted code

AST06