Skills lark-whiteboard-cli
📦
lark-whiteboard-cli
Content revision r1 High Risk ⚡ Contains scripts⚙️ External commands📁 Filesystem access🌐 Network access
Create Lark Whiteboard Diagrams
Teams need clear diagrams inside Lark without hand-building every layout. This skill guides Claude, Codex, and Claude Code through whiteboard-cli workflows for polished visual outputs.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "lark-whiteboard-cli" from https://skillstore.io/skills/larksuite-lark-whiteboard-cli.md and its manifest at https://skillstore.io/api/skills/larksuite-lark-whiteboard-cli/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "lark-whiteboard-cli". Create a microservice architecture diagram for checkout.
Expected outcome:
A rendered PNG with grouped service layers, connectors, and a short review note about layout and readability.
Using "lark-whiteboard-cli". Make a Mermaid mind map for a product launch plan.
Expected outcome:
A whiteboard-ready mind map image with concise branches for research, build, launch, and follow-up.
Using "lark-whiteboard-cli". Upload this process diagram to my existing Lark whiteboard.
Expected outcome:
A prepared upload workflow that checks the target board first and asks for confirmation before any overwrite.
Security Audit
High Riskv4 • 7/5/2026 Open versioned report
Most high-entropy, path traversal, reconnaissance, and Mermaid findings are false positives from Chinese markdown documentation, examples, and relative links. Confirmed risks are the intended command workflows: npm or npx execution, generated Node scripts, and authenticated lark-cli document or whiteboard updates. No prompt injection text was found in the reviewed files.
21
Files scanned
4,302
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Generated Script Injection Risk
The skill requires generated JavaScript for some diagrams and templates place user-derived diagram text into executable script data. Without explicit JSON serialization or escaping, malicious labels could become code when node runs the script.
The files clearly require generated scripts and show user-facing labels inside JavaScript string data. The risk depends on agent substitution behavior, so confidence is high but not absolute.
High
Authenticated Lark Whiteboard Overwrite Risk
The upload workflow fetches and updates Lark documents and whiteboards under an authenticated identity. A wrong token, document id, or overwrite confirmation could modify or delete remote whiteboard content.
The referenced lines include lark-cli fetch, document update, mandatory dry-run, and final whiteboard update commands. The dry-run reduces likelihood but confirms the workflow can mutate remote content.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
| 文档 URL 或 doc_id,需要新建画板 | `lark-cli docs +update --doc <doc_id> --mode append --markdown '<whiteb
The line uses lark-cli docs +update to append a whiteboard to a document. This can mutate remote Lark content under the authenticated user identity.
High
Ruby/shell backtick execution
```bash
This begins the final upload command block that pipes whiteboard-cli output into lark-cli whiteboard update with --yes. It can change remote whiteboard content.
Medium
Ruby/shell backtick execution
> 如果执行失败,手动安装后重试:`npm install -g @larksuite/whiteboard-cli@^0.2.0`
The line instructs a global npm install of @larksuite/whiteboard-cli. Installing packages can execute lifecycle scripts and adds supply-chain risk.
Medium
Ruby/shell backtick execution
> 执行 `npm install` 安装新的依赖前,务必征得用户同意!
The line explicitly discusses running npm install for new dependencies. It requires consent, but dependency installation remains a real execution risk.
Medium
Ruby/shell backtick execution
- 推荐使用图标让图表更直观,运行 `npx -y @larksuite/whiteboard-cli@^0.2.0 --icons` 查看可用图标,选取合适的图标, 但不要过度使用或者所有图表都用图
The workflow tells the agent to run npx -y @larksuite/whiteboard-cli to list icons. npx -y can fetch and execute package code without an interactive prompt.
Medium
Ruby/shell backtick execution
> **构建方式是强约束**:当 scene 指南要求"脚本生成"时,必须先写脚本(.js)并用 `node` 执行来产出 JSON 文件。绝对定位场景(鱼骨图、飞轮图、柱状图、折线图等)的坐标需要数
The skill requires writing a JavaScript file and running node to generate diagram JSON. Executing generated scripts is risky if user text is not serialized safely.
Medium
Ruby/shell backtick execution
```bash
This begins a bash command block for running npx to inspect available icons. The command executes an npm package in the local environment.
Medium
Ruby/shell backtick execution
```bash
This begins a bash command block for rendering diagrams with npx. Rendering is intended behavior, but it still executes package code from the command line.
Medium
Ruby/shell backtick execution
| 文档 URL 或 doc_id,文档中已有画板 | `lark-cli docs +fetch --doc <URL> --as user`,从返回的 `<whiteboard token=”XX
The line uses lark-cli docs +fetch under user authentication. Fetching document content through a CLI can expose data if the target URL or permissions are wrong.
Medium
Ruby/shell backtick execution
> ```bash
This begins a bash command block that performs a dry-run whiteboard update. The dry run is a safeguard, but it still invokes authenticated CLI tooling.
Risk Factors
⚡ Contains scripts (1)
⚙️ External commands (66)
scenes/fishbone.md:172-186 scenes/flywheel.md:123-132 scenes/flywheel.md:132-134 scenes/flywheel.md:134-188 SKILL.md:12 SKILL.md:13 SKILL.md:16 SKILL.md:23-33 SKILL.md:33-53 SKILL.md:53-55 SKILL.md:55-59 SKILL.md:59-61 SKILL.md:61-79 SKILL.md:79 SKILL.md:90-91 SKILL.md:91-92 SKILL.md:92-93 SKILL.md:93-94 SKILL.md:94-95 SKILL.md:95-102 SKILL.md:102-103 SKILL.md:103-104 SKILL.md:104-105 SKILL.md:105-106 SKILL.md:106-107 SKILL.md:107-108 SKILL.md:108-109 SKILL.md:109-110 SKILL.md:110-111 SKILL.md:111-112 SKILL.md:112-113 SKILL.md:113-114 SKILL.md:114-115 SKILL.md:115-121 SKILL.md:121 SKILL.md:123-130 SKILL.md:130-135 SKILL.md:135-137 SKILL.md:137-140 SKILL.md:140-143 SKILL.md:143-147 SKILL.md:147-153 SKILL.md:153-154 SKILL.md:154 SKILL.md:155 SKILL.md:157-165 SKILL.md:165-166 SKILL.md:166-168 SKILL.md:168-172 SKILL.md:172-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175 SKILL.md:177-179 SKILL.md:179-180 SKILL.md:180 SKILL.md:181 SKILL.md:217-218 SKILL.md:218 SKILL.md:219 SKILL.md:222-223 SKILL.md:223 SKILL.md:226-231 SKILL.md:231-232 SKILL.md:232-234 SKILL.md:234
📁 Filesystem access (13)
🌐 Network access (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/larksuite-lark-whiteboard-cli/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/larksuite-lark-whiteboard-cli?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/larksuite-lark-whiteboard-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/larksuite-lark-whiteboard-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/larksuite-lark-whiteboard-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
larksuite. (2026). lark-whiteboard-cli security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/larksuite-lark-whiteboard-cli/audits/4BibTeX citation
@techreport{larksuite-larksuite-lark-whiteboard-cli-2026,
author = {larksuite},
title = {lark-whiteboard-cli security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/larksuite-lark-whiteboard-cli/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "lark-whiteboard-cli security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "larksuite"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/larksuite-lark-whiteboard-cli/audits/4"
identifiers:
- type: other
value: "skillstore:larksuite-lark-whiteboard-cli:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 45
Architecture
85
Maintainability
87
Content
72
Community
83
Spec Compliance
What You Can Build
Document System Architecture
Create a layered service diagram with grouped components, connectors, and readable styling for engineering reviews.
Explain Product Workflows
Turn a business process into a clear flowchart with decisions, states, and concise labels.
Prepare Lark Collaboration Diagrams
Generate whiteboard-ready diagrams and optionally upload them to a Lark document after confirmation.
Try These Prompts
Create a Basic Diagram
Create a simple Lark whiteboard architecture diagram for a web app with frontend, API, database, and cache layers.
Convert Mermaid Input
Use the Mermaid workflow to render my sequence diagram as a Lark whiteboard PNG. Keep labels short and readable.
Build a Structured Analysis Diagram
Create a fishbone diagram for slow checkout performance. Group causes by frontend, backend, database, network, and third-party services.
Render and Upload Safely
Create a detailed onboarding flowchart, render it, then prepare a Lark whiteboard upload. Run a dry run and ask before overwriting anything.
Best Practices
- Confirm the diagram type, target audience, and upload destination before running commands.
- Use short node labels and move long explanations into nearby notes or legends.
- Run the dry-run overwrite check before updating any existing Lark whiteboard.
Avoid
- Do not run npm install, npx, node scripts, or lark-cli commands without user approval.
- Do not paste untrusted text directly into executable JavaScript templates.
- Do not overwrite an existing whiteboard without confirming the deletion count and target token.
Frequently Asked Questions
What does this skill create?
It creates Lark whiteboard diagrams, rendered PNG files, and optional upload workflows for Lark documents.
Does it require Lark authentication?
Authentication is only required when fetching documents or uploading diagrams to Lark whiteboards.
Can it use Mermaid diagrams?
Yes. It uses Mermaid for mind maps, sequence diagrams, class diagrams, pie charts, and explicit Mermaid input.
Can it make custom layouts?
Yes. The DSL workflow supports structured layouts, precise positions, connectors, colors, and scene-specific diagram rules.
What files can it generate?
It can generate diagram source files, helper scripts for calculated layouts, rendered PNG images, and Mermaid source files.
What should users review before upload?
Users should verify the target document, whiteboard token, authentication identity, and any overwrite warning from the dry run.