feishu-cli-board
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/svg_to_board.pyusessubprocess.run()to execute local CLI tools (whiteboard-cliandfeishu-cli). These calls use a list of arguments rather than a shell string, mitigating shell injection risks. This execution is necessary for the skill's primary function of converting SVG data into Feishu board nodes. - [EXTERNAL_DOWNLOADS]: The skill documentation instructs users to install
feishu-clifrom the author's GitHub repository (riba2534/feishu-cli) and@larksuite/whiteboard-clifrom the NPM registry. Both sources are legitimate in the context of this skill, representing the vendor's own tools and well-known software for the target platform (Feishu/Lark). - [SAFE]: The skill handles sensitive credentials, such as App IDs and Secrets, through standard environment variables or local configuration files, following security best practices.
- [SAFE]: No obfuscation, data exfiltration patterns, or persistence mechanisms were found in the provided scripts or documentation.
Audit Metadata