lark-whiteboard
Pass
Audited by Gen Agent Trust Hub on Mar 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and runs local JavaScript files (e.g.,
generate-fishbone.js,generate-flywheel.js) usingnode. These scripts calculate geometric coordinates for diagram nodes. This represents dynamic execution of generated code. - [REMOTE_CODE_EXECUTION]: Uses
npxto fetch and execute the@larksuite/whiteboard-clipackage. While this is a vendor-owned package, thenpxcommand executes code from an external source at runtime. - [EXTERNAL_DOWNLOADS]: Instructions include downloading and installing the
@larksuite/whiteboard-clinpm package vianpm install -gornpx. This fetches code from the npm registry. - [COMMAND_EXECUTION]: Executes
lark-clicommands to interact with Lark document APIs, including+fetchfor fetching whiteboard tokens and+whiteboard-updatefor uploading diagram data. This involves authenticated network requests to vendor services.
Audit Metadata