Skip to content
skillsafebeta
← Report library
Purpose / Documents

Lark Doc Skill Security Audit

What the author says it does (original text)

飞书云文档（Docx / Wiki）内容操作：读取、创建、编辑文档，插入或下载图片附件，以及操作思维笔记。用户提供文档 URL/token（包括 doubao.com 的 /docx/、/wiki/）时使用；按 URL 路径/token 而非域名路由。文档内嵌资源按读取参考中的统一规则分流。独立评论操作走 lark-drive；随正文读取评论使用 docs +fetch。表格或 Base 内部数据操作不在本 skill。

Independent security check

Do not install or run it yet

Files checked
59
Risks found
5
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

Whiteboard workflows automatically download and execute a floating npm package

Source references: 5
What we found

The Skill requires running `npx -y @larksuite/whiteboard-cli@^0.2.13` without asking the user and repeatedly uses it for rendering and conversion. `-y` accepts installation automatically, while `^0.2.13` permits later compatible releases; no lockfile or integrity verification is shown.

Why this matters

The resolved package and installation scripts run with the agent process's access to workspace files and environment data. A compromised supply chain or changed later release could execute code, read data, or alter files.

This is an active startup instruction to run `npx -y` without asking. `-y` automatically accepts installation and `^0.2.13` is not an exact version; the package is then executed again for rendering and conversion. If the registry account or an allowed compatible release is compromised, its code runs with the agent's permissions and may access the working directory or process-visible credentials. Users can block network installs and require an exact, integrity-verified dependency.

lark-whiteboard/SKILL.md:15In the instructionsOpen original file
> - 运行 `lark-cli --version`，确认可用，无需询问用户。> - 运行 `npx -y @larksuite/whiteboard-cli@^0.2.13 -v`，确认可用，无需询问用户。
Show 4 other places
lark-whiteboard/routes/dsl.md:28In the instructionsOpen original file
  - 渲染前自查（见下方检查清单）  - 渲染 PNG（仅用于预览验证，不是最终产物）：npx -y @larksuite/whiteboard-cli@^0.2.13 -i diagram.json -o diagram.png  - 检查：信息完整？布局合理？配色协调？文字无截断？连线无交叉？
lark-whiteboard/references/lark-whiteboard-update.md:78In the instructionsOpen original file
# 使用 whiteboard-cli 生成 OpenAPI 格式并通过管道传递npx -y @larksuite/whiteboard-cli@^0.2.13 -i <产物文件> --to openapi --format json \  | lark-cli whiteboard +update \    --whiteboard-token <画板Token> \    --source - --input_format raw \    --idempotent-token <10+字符唯一串> \    --as user```
lark-whiteboard/SKILL.md:13In the instructionsOpen original file
> [!IMPORTANT]> - 运行 `lark-cli --version`，确认可用，无需询问用户。> - 运行 `npx -y @larksuite/whiteboard-cli@^0.2.13 -v`，确认可用，无需询问用户。
lark-whiteboard/routes/dsl.md:26In the instructionsOpen original file
Step 3: 渲染 & 审查 → 交付  - 渲染前自查（见下方检查清单）  - 渲染 PNG（仅用于预览验证，不是最终产物）：npx -y @larksuite/whiteboard-cli@^0.2.13 -i diagram.json -o diagram.png  - 检查：信息完整？布局合理？配色协调？文字无截断？连线无交叉？  - 有问题 → 按症状表修复 → 重新渲染（最多 2 轮）  - 2 轮后仍有严重问题 → 考虑走 Mermaid 路径兜底  - 写入画板：用 whiteboard-cli 将 diagram.json 转换为 OpenAPI 格式并 pipe 给 +update：      npx -y @larksuite/whiteboard-cli@^0.2.13 -i diagram.json --to openapi --format json \        | lark-cli whiteboard +update --whiteboard-token <board_token> \            --source - --input_format raw --idempotent-token <时间戳+标识> --as user      → 完整 dry-run / 确认流程见 [§ 写入画板](../references/lark-whiteboard-workflow.md#写入画板)
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
High risk

Whiteboard image flow may fetch internal resources and upload them to Lark

Source references: 6
What we found

The whiteboard flow runs `curl -L` directly for network images without requiring HTTPS-only URLs, private-address rejection, or per-redirect validation. It then requires the downloaded file to be uploaded to the target whiteboard. This path lacks the address checks explicitly required by another download path in the same Skill.

Why this matters

A malicious or compromised URL could cause requests to intranet, loopback, or cloud-metadata endpoints. If the response is accepted as an image, it may then be uploaded to Lark, exposing internal information.

For a network image, the workflow directly uses `curl -L` and then requires uploading the resulting file to the target whiteboard. Unlike the documented fetch safeguards, this path does not restrict requests to HTTPS, reject private/loopback addresses, or validate every redirect. If a user or document supplies an internal URL, the agent environment could request it and upload the response to Lark. Users can require a restricted downloader plus host and redirect controls.

lark-whiteboard/elements/image.md:20In the instructionsOpen original file
| 本地文件 | 直接使用 || 网络 URL | `curl -L -o photo.jpg "<URL>"` || 文档中的图片 token | `lark-cli docs +media-download --token <token> --output ./photo.png` |
Show 5 other places
lark-whiteboard/elements/image.md:51In the instructionsOpen original file
**必须**使用 `docs +media-upload --parent-type whiteboard` 上传：```bashlark-cli docs +media-upload --file ./photo1.jpg --parent-type whiteboard --parent-node <whiteboard_token># 响应: { "file_token": "<media_token>", ... }
references/lark-doc-fetch.md:126In the instructionsOpen original file
|-|-||`<img>`、`<source>`|有 `url` 时仅下载可信的公开 HTTPS URL：拒绝 userinfo 及解析到 private、loopback、link-local、multicast、unspecified 地址的 host，并逐次校验重定向；不满足时禁止请求。无 `url` 时提取 `token`，预览用 `docs +media-preview`，下载用 `docs +media-download`||`<whiteboard>`|提取 `token`，使用 `docs +media-download`|
lark-whiteboard/elements/image.md:17In the instructionsOpen original file
| 图片来源 | 获取方式 ||---------|---------|| 本地文件 | 直接使用 || 网络 URL | `curl -L -o photo.jpg "<URL>"` || 文档中的图片 token | `lark-cli docs +media-download --token <token> --output ./photo.png` || 其他域的 Drive token | `lark-cli docs +media-download --token <token> --output ./photo.png` |
lark-whiteboard/elements/image.md:49In the instructionsOpen original file
### 3. 上传到目标画板**必须**使用 `docs +media-upload --parent-type whiteboard` 上传：```bashlark-cli docs +media-upload --file ./photo1.jpg --parent-type whiteboard --parent-node <whiteboard_token># 响应: { "file_token": "<media_token>", ... }```
references/lark-doc-fetch.md:124In the instructionsOpen original file
|返回内容|处理方式||-|-||`<img>`、`<source>`|有 `url` 时仅下载可信的公开 HTTPS URL：拒绝 userinfo 及解析到 private、loopback、link-local、multicast、unspecified 地址的 host，并逐次校验重定向；不满足时禁止请求。无 `url` 时提取 `token`，预览用 `docs +media-preview`，下载用 `docs +media-download`||`<whiteboard>`|提取 `token`，使用 `docs +media-download`||`<sheet>`、`<cite file-type="sheets">`|提取 `token` 和 `sheet-id`，转到 [`lark-sheets`](../../lark-sheets/SKILL.md)|
Medium risk

Complex whiteboards disclose document tokens and source material to additional subagents

Source references: 5
What we found

Complex SVG work and updates to existing whiteboards are required to use a subagent, with document or board tokens, insertion locations, and relevant source paragraphs or data explicitly forwarded. A request to edit a document does not necessarily authorize copying that material into additional agent contexts.

Why this matters

Access identifiers, internal document text, and business data enter more model contexts, logs, or processing boundaries, increasing exposure. Consequences are greater if a token itself conveys access.

Complex SVG work and existing-whiteboard updates are explicitly delegated to a SubAgent with the document/board token, insertion location, and source paragraphs or data. This occurs only when those branches are triggered. The source does not show that the SubAgent is an external service or that disclosure occurred, but it does expand where sensitive document content and resource identifiers are processed. Users can prohibit delegation or require redacted excerpts and no reusable tokens.

references/lark-doc-whiteboard.md:47In the instructionsOpen original file
主 Agent 启动 SubAgent，让它用 `docs +create` / `docs +update` 插入：
Show 4 other places
references/lark-doc-whiteboard.md:61In the instructionsOpen original file
- doc token、插入位置（标题 / block_id / command）- 图表目标、受众、源段落或数据- 要求读取 `lark-doc-xml.md`；不需要读取 `lark-whiteboard`- SVG 必须完整自包含：包含 `<svg>` 根节点和 `viewBox`，不引用外部图片、脚本、远程资源
references/lark-doc-whiteboard.md:132In the instructionsOpen original file
复杂图和已有画板更新必须启动 SubAgent。主 Agent 只传最小上下文，不直接执行 `lark-whiteboard` 的渲染和写入流程。复杂图 SubAgent 的最小上下文：- board_token- 图表目标、推荐画板类型、受众- 与图表直接相关的源段落或数据- 要求读取 [`../../lark-whiteboard/SKILL.md`](../../lark-whiteboard/SKILL.md)，按其完整流程写入该 board_token
references/lark-doc-whiteboard.md:45In the instructionsOpen original file
### 步骤 2B: SubAgent 使用 SVG 插入图表主 Agent 启动 SubAgent，让它用 `docs +create` / `docs +update` 插入：```xml<whiteboard type="svg">    <svg...>...    </svg></whiteboard>```如果 SVG 已在本地文件中，可写成 `<whiteboard type="svg" path="@./diagram.svg"></whiteboard>`；PlantUML 文件同理使用 `<whiteboard type="plantuml" path="@./sequence.puml"></whiteboard>`。Sub Agent 需要携带以下的最小上下文，以及后续的 [SVG 设计 Workflow] 章节指南：- doc token、插入位置（标题 / block_id / command）- 图表目标、受众、源段落或数据- 要求读取 `lark-doc-xml.md`；不需要读取 `lark-whiteboard`- SVG 必须完整自包含：包含 `<svg>` 根节点和 `viewBox`，不引用外部图片、脚本、远程资源
references/lark-doc-whiteboard.md:130In the instructionsOpen original file
### 步骤 3B：编辑已有画板 — 启动 lark-whiteboard SubAgent复杂图和已有画板更新必须启动 SubAgent。主 Agent 只传最小上下文，不直接执行 `lark-whiteboard` 的渲染和写入流程。复杂图 SubAgent 的最小上下文：- board_token- 图表目标、推荐画板类型、受众- 与图表直接相关的源段落或数据- 要求读取 [`../../lark-whiteboard/SKILL.md`](../../lark-whiteboard/SKILL.md)，按其完整流程写入该 board_token多个画板互不依赖时，可并行启动多个 SubAgent；每个 SubAgent 只负责一个画板或一个 SVG 插入点，不要互相复用上下文。
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
Medium risk

Revision fallback rewrites the entire document and may permanently lose comments or other objects

Source references: 4
What we found

When no history entry matches a requested revision_id but the target body remains readable, the workflow removes old block IDs and performs one `overwrite`. The documentation also states that overwrite rebuilds the body and block IDs and cannot guarantee preservation of comments or other non-body objects.

Why this matters

Restoring the body may delete comments, unsupported resources, or links and automations that depend on old block IDs. The subsequent body comparison cannot recover those non-body objects.

When no matching history record exists but the requested revision remains readable, the fallback removes old block IDs and rewrites the full document with `overwrite`. The documentation warns that this rebuilds content and block IDs and cannot guarantee preservation of comments or other non-body objects; the update reference also says images and comments can be lost. Authorization to “revert” may not be informed consent to those collateral losses. Users can require backups/exports and separate confirmation before overwrite.

references/lark-doc-history.md:9In the instructionsOpen original file
- `overwrite` 会重建正文和 block ID，且无法保证保留评论等非正文对象。用户要求保留这些对象时，应先说明限制并确认。- `overwrite` 返回 warning 或 `partial_success` 时，先核验最新内容。核验失败或发生 revision conflict 时停止，不要再次覆盖。- 权限、网络或临时系统错误应保留原错误分类，不得解释为目标版本不存在。
Show 3 other places
references/lark-doc-history.md:19In the instructionsOpen original file
2. 找到目标记录后，使用该记录的 `history_version_id` 调用 `+history-revert`。不要将 `revision_id` 传给回滚接口。返回 `running` 时使用 `+history-revert-status` 查询；只有 `done` 表示成功，其他终态均停止并报告。3. 没有目标记录但用户指定了 `revision_id` 时，可读取目标版本并恢复正文：   - 使用 `docs +fetch --doc "<doc>" --revision-id <revision_id> --scope full --detail full --format json` 读取目标版本。确认文档一致、返回的 `revision_id` 与目标一致，且 `content` 不是 `<fragment>`。   - 使用 `docs +fetch --doc "<doc>" --scope full --detail full --format json` 读取当前完整文档，其 `content` 同样不得是 `<fragment>`。目标与当前响应的 `revision_id` 相同时直接结束，不执行 `overwrite`。否则移除目标 `content` 中旧的 block ID，将正文写入任务目录下的相对路径，然后仅执行一次 `docs +update --doc "<doc>" --command overwrite --revision-id <current_revision_id> --content @target.xml`，其中 `current_revision_id` 来自当前文档响应。目标响应包含非空 JSON object 形式的 `reference_map` 时，将其写入相对路径并追加 `--reference-map @target-reference-map.json`；否则省略该参数。`+update` 不支持 `--yes`。   - 使用 `docs +fetch --doc "<doc>" --scope full --detail full --format json` 读取最新完整文档并核验。忽略重新生成的 block ID，正文结构、文本、链接和引用资源应与目标版本一致。4. 目标版本明确不可读时停止并报告。
references/lark-doc-history.md:7In the instructionsOpen original file
## 安全约束- `overwrite` 会重建正文和 block ID，且无法保证保留评论等非正文对象。用户要求保留这些对象时，应先说明限制并确认。- `overwrite` 返回 warning 或 `partial_success` 时，先核验最新内容。核验失败或发生 revision conflict 时停止，不要再次覆盖。- 权限、网络或临时系统错误应保留原错误分类，不得解释为目标版本不存在。
references/lark-doc-update.md:67In the instructionsOpen original file
|-|-|-||`str_replace`|全文查找替换；支持富文本内的文本替换，但不支持资源替换；涉及多个 block 时建议用 `block_replace`；空 `--content` 表示删除|`--pattern`、`--content`||`block_insert_after`|在指定 block 后插入内容；逐章填充时指定对应标题的 block ID|`--block-id`、`--content`||`block_copy_insert_after`|按 ID 顺序复制源 block，源 block 不变；基础标签均支持，资源块仅支持 `img`、`source`、`whiteboard`、`sheet`、`chat_card`、`sub-page-list`，不支持 `task`、`bitable`、`base_ref`、`synced_reference`、`synced_source`、`okr`|`--block-id`、`--src-block-ids`||`block_replace`|替换单个 block（`--block-id`）或同父连续闭区间（`--start-block-id`/`--end-block-id`）；不支持跨容器或反向区间|`--content`，以及 `--block-id` 或 `--start-block-id`+`--end-block-id`||`block_delete`|删除单个 block（`--block-id`）或同父连续闭区间（`--start-block-id`/`--end-block-id`）；不支持跨容器或反向区间|`--block-id` 或 `--start-block-id`+`--end-block-id`||`block_move_after`|移动已有 block，支持所有块类型；|`--block-id`、`--src-block-ids`||`append`|仅在文末追加，等价于 `block_insert_after --block-id -1`|`--content`||`overwrite`|清空后重写全文，丢失图片、评论等内容，非必要不使用|`--content`|
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

Whiteboard routing asks the model to disclose training provenance and changes behavior accordingly

Source references: 3
What we found

The workflow requires the agent to identify its provider “according to training source,” then uses that identity to select SVG or DSL. Model provenance is unnecessary user data for operating a Lark whiteboard and is not a reliable runtime capability test.

Why this matters

This can induce disclosure or guessing of internal identity information and makes identical requests follow different implementations solely because of a brand declaration, reducing predictability and audit consistency.

Legitimate use of this code

The workflow does require the model to identify its family and uses that answer to route between SVG and DSL, but this is a capability heuristic for choosing an output format. It neither asks the user for secrets, credentials, or account data nor shows the answer being sent to a third party. An inaccurate self-identification could select a poorer rendering path, but the cited source does not support a security risk to user files, credentials, or accounts.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
lark-whiteboard/references/lark-whiteboard-workflow.md:47In the instructionsOpen original file
**先自报身份**：按训练来源，你属于哪一家？`Claude` / `Gemini` / `GPT` / `GLM` / `Doubao 或 Seed` / `Other`。身份决定 SVG / DSL 分流（不同家族对这两种表达语言的能力不均衡），不要跳过这一步。**然后按当前产物类型 / 图表类型 × 身份选路径**，读对应文件按其完整 workflow 执行（含读 scene 指南、生成内容、渲染审查、交付）：
Show 2 other places
lark-whiteboard/references/lark-whiteboard-workflow.md:45In the instructionsOpen original file
### 渲染路由**先自报身份**：按训练来源，你属于哪一家？`Claude` / `Gemini` / `GPT` / `GLM` / `Doubao 或 Seed` / `Other`。身份决定 SVG / DSL 分流（不同家族对这两种表达语言的能力不均衡），不要跳过这一步。**然后按当前产物类型 / 图表类型 × 身份选路径**，读对应文件按其完整 workflow 执行（含读 scene 指南、生成内容、渲染审查、交付）：
lark-whiteboard/references/lark-whiteboard-workflow.md:53In the instructionsOpen original file
| 图表类型               | 身份                                  | 路径                                             ||--------------------|-------------------------------------|------------------------------------------------|| 当前要生成/追加的内容包含 @用户提及或图片/配图 | 任何身份                                | [`../routes/dsl.md`](../routes/dsl.md)         || 思维导图、时序图、类图、饼图、甘特图 | 任何身份                                | [`../routes/mermaid.md`](../routes/mermaid.md) || 鱼骨图、金字塔图、流程图    | `Doubao` / `Seed`                   | [`../routes/dsl.md`](../routes/dsl.md)         || 其他图表               | `Claude` / `Gemini` / `GPT` / `GLM` / `Doubao` / `Seed`  | [`../routes/svg.md`](../routes/svg.md)         || 其他图表               | `Other`                             | [`../routes/dsl.md`](../routes/dsl.md)         |
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

2 instruction sections

The Skill invokes lark-cli as the user to read, create, and precisely modify Lark documents. Its editing workflow requires reading the target range first and fetching it again after each write for verification.

View source
SKILL.md:17In the instructionsOpen original file
**身份：文档操作推荐显式指定 `--as user`。**
references/lark-doc-update.md:29In the instructionsOpen original file
1. **Observe（读取现状）**：先 `docs +fetch` 读取当前文档状态，并按意图选择最小范围。   - 改某一节或大文档：先 `--scope outline --max-depth 2` 找章节，再 `--scope section --start-block-id <标题id> --detail with-ids`
references/lark-doc-update.md:37In the instructionsOpen original file
4. **Patch（精确修改）**：按 block / section 执行局部命令。替换内容必须符合目标父容器的结构；例如替换列表项范围时使用 `<li>...</li>`。保护 `<cite>`、`<img>`、`<source>`、`<whiteboard>`、`<sheet>`、`<bitable>`、`<synced_reference>` 等 token 化内容，不要改成纯文本或占位符。同一 block 的多处修改合并成一次 `block_replace`。5. **Verify（fetch 验证）**：每轮写操作后按影响范围重新 fetch，检查用户要求、结构、语气、事实、资源块和 block ID 是否符合预期；不满足就基于最新 fetch 结果继续 Diagnose / Patch，不要沿用上一轮 block ID。

The Skill can upload images or attachments from local files or the system clipboard to a Lark document. Its instructions require confirming the user's intent before writing and asking the user for an explicit path if clipboard input fails.

View source
references/lark-doc-media-insert.md:12In the instructionsOpen original file
>> - 用户说"把这张截图插进去"、"用剪切板里的图"、"我刚复制的" → 无条件走 `--from-clipboard`。> - 用户说"用 `~/Downloads/foo.png`"、"插本地这个文件"、给了具体路径 → 无条件走 `--file`。> - 用户两者都没说清 → 按下表的启发式推断。
references/lark-doc-media-insert.md:35In the instructionsOpen original file
1. 先用 `--from-clipboard` 试一次。2. 如果返回"no image data"类错误，**向用户明确说明剪切板里没有可识别的图片**，请用户提供本地文件路径或重新复制一张图。3. 拿到本地路径后，用 `--file <path>` 重试**同一条插入命令**（其他参数如 `--doc` / `--align` / `--caption` 保持不变）。
references/lark-doc-media-insert.md:108In the instructionsOpen original file
> [!CAUTION]> 这是**写入操作**（会修改文档内容）—— 执行前必须确认用户意图。

Document reads may also return unresolved comments visible to the current user and referenced-resource metadata. The default summary mode omits block IDs and full styling metadata.

View source
references/lark-doc-fetch.md:8In the instructionsOpen original file
```bash# 读取整篇文档，并附带当前用户可见的未解决评论；lark-cli docs +fetch --doc "文档URL或token"
references/lark-doc-fetch.md:42In the instructionsOpen original file
|-|-|-||浏览、总结|`simple`（默认）|简洁 XML/Markdown，不含 block ID、样式和引用元数据||定位、跳转|`with-ids`|包含 block ID，可用于 `+update --block-id`，也可拼成 `文档URL#block_id` 直达链接||编辑文档|`full`|包含 block ID、样式和引用元数据，保留完整结构信息|

Some remote-image paths are explicitly limited to public HTTPS and validate private, loopback, link-local addresses and every redirect. The generic curl path used for whiteboard image preparation does not state equivalent restrictions.

View source
references/lark-doc-fetch.md:126In the instructionsOpen original file
|-|-||`<img>`、`<source>`|有 `url` 时仅下载可信的公开 HTTPS URL：拒绝 userinfo 及解析到 private、loopback、link-local、multicast、unspecified 地址的 host，并逐次校验重定向；不满足时禁止请求。无 `url` 时提取 `token`，预览用 `docs +media-preview`，下载用 `docs +media-download`||`<whiteboard>`|提取 `token`，使用 `docs +media-download`|
lark-whiteboard/elements/image.md:20In the instructionsOpen original file
| 本地文件 | 直接使用 || 网络 URL | `curl -L -o photo.jpg "<URL>"` || 文档中的图片 token | `lark-cli docs +media-download --token <token> --output ./photo.png` |
Start here · InstructionsSKILL.md
lark-doc
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 40
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records59 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/lark-doc-create-workflow.mdFull text included
  • references/lark-doc-create.mdFull text included
  • references/lark-doc-fetch.mdFull text included
  • references/lark-doc-history.mdFull text included
  • references/lark-doc-media-download.mdFull text included
  • references/lark-doc-media-insert.mdFull text included
  • references/lark-doc-media-preview.mdFull text included
  • references/lark-doc-mindnote.mdFull text included
  • references/lark-doc-resource-cover.mdFull text included
  • references/lark-doc-script.mdFull text included
  • references/lark-doc-update.mdFull text included
  • references/lark-doc-whiteboard.mdFull text included
  • lark-contact/references/lark-contact-get-user.mdFull text included
  • lark-contact/references/lark-contact-search-bot.mdFull text included
  • lark-contact/references/lark-contact-search-user.mdFull text included
  • lark-whiteboard/elements/image.mdFull text included
  • lark-whiteboard/references/lark-whiteboard-export.mdFull text included
  • lark-whiteboard/references/lark-whiteboard-update.mdFull text included
  • lark-whiteboard/references/lark-whiteboard-workflow.mdFull text included
  • lark-whiteboard/routes/dsl.mdFull text included
  • lark-whiteboard/routes/mermaid.mdFull text included
  • lark-whiteboard/routes/svg-edit.mdFull text included
  • lark-whiteboard/routes/svg.mdFull text included
  • lark-whiteboard/scenes/mention.mdFull text included
  • lark-whiteboard/scenes/photo-showcase.mdFull text included
  • references/genres/business-analysis.mdFull text included
  • references/genres/data-report.mdFull text included
  • references/genres/email.mdFull text included
  • references/genres/execution-plan.mdFull text included
  • references/genres/formal-doc.mdFull text included
  • references/genres/meeting-minutes.mdFull text included
  • references/genres/memo-brief.mdFull text included
  • references/genres/official-redhead.mdFull text included
  • references/genres/prd.mdFull text included
  • references/genres/proposal.mdFull text included
  • references/genres/research-report.mdFull text included
  • references/genres/retrospective.mdFull text included
  • references/genres/route-consumer.mdFull text included
  • references/genres/route-creative.mdFull text included
  • references/genres/route-knowledge.mdFull text included
  • references/genres/route-marketing.mdFull text included
  • references/genres/route-media.mdFull text included
  • references/genres/route-opinion.mdFull text included
  • references/genres/route-personal-brand.mdFull text included
  • references/genres/route-platform.mdFull text included
  • references/genres/route-report.mdFull text included
  • references/genres/route-workplace.mdFull text included
  • references/genres/sop-tutorial.mdFull text included
  • references/genres/technical-doc.mdFull text included
  • references/genres/wechat.mdFull text included
  • references/genres/weekly-report.mdFull text included
  • references/genres/white-paper.mdFull text included
  • references/genres/xiaohongshu.mdFull text included
  • references/lark-doc-md.mdFull text included
  • references/lark-doc-xml-extended-blocks.mdFull text included
  • references/lark-doc-xml.mdFull text included
  • lark-contact/SKILL.mdFull text included
  • lark-whiteboard/SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/genres/business-analysis.mdSupporting file
  • references/genres/data-report.mdSupporting file
  • references/genres/email.mdSupporting file
  • references/genres/execution-plan.mdSupporting file
  • references/genres/formal-doc.mdSupporting file
  • references/genres/meeting-minutes.mdSupporting file
  • references/genres/memo-brief.mdSupporting file
  • references/genres/official-redhead.mdSupporting file
  • references/genres/prd.mdSupporting file
  • references/genres/proposal.mdSupporting file
  • references/genres/research-report.mdSupporting file
  • references/genres/retrospective.mdSupporting file
  • references/genres/route-consumer.mdSupporting file
  • references/genres/route-creative.mdSupporting file
  • references/genres/route-knowledge.mdSupporting file
  • references/genres/route-marketing.mdSupporting file
  • references/genres/route-media.mdSupporting file
  • references/genres/route-opinion.mdSupporting file
  • references/genres/route-personal-brand.mdSupporting file
  • references/genres/route-platform.mdSupporting file
  • references/genres/route-report.mdSupporting file
  • references/genres/route-workplace.mdSupporting file
  • references/genres/sop-tutorial.mdSupporting file
  • references/genres/technical-doc.mdSupporting file
  • references/genres/wechat.mdSupporting file
  • references/genres/weekly-report.mdSupporting file
  • references/genres/white-paper.mdSupporting file
  • references/genres/xiaohongshu.mdSupporting file
  • references/lark-doc-create-workflow.mdSupporting file
  • references/lark-doc-create.mdSupporting file
  • references/lark-doc-fetch.mdSupporting file
  • references/lark-doc-history.mdSupporting file
  • references/lark-doc-md.mdSupporting file
  • references/lark-doc-media-download.mdSupporting file
  • references/lark-doc-media-insert.mdSupporting file
  • references/lark-doc-media-preview.mdSupporting file
  • references/lark-doc-mindnote.mdSupporting file
  • references/lark-doc-resource-cover.mdSupporting file
  • references/lark-doc-script.mdSupporting file
  • references/lark-doc-update.mdSupporting file
  • references/lark-doc-whiteboard.mdSupporting file
  • references/lark-doc-xml-extended-blocks.mdSupporting file
  • references/lark-doc-xml.mdSupporting file
  • lark-whiteboard/SKILL.mdSupporting file
  • lark-whiteboard/references/lark-whiteboard-export.mdSupporting file
  • lark-whiteboard/references/lark-whiteboard-update.mdSupporting file
  • lark-whiteboard/routes/svg-edit.mdSupporting file
  • lark-whiteboard/references/lark-whiteboard-workflow.mdSupporting file
  • lark-whiteboard/routes/svg.mdSupporting file
  • lark-whiteboard/routes/dsl.mdSupporting file
  • lark-whiteboard/routes/mermaid.mdSupporting file
  • lark-whiteboard/scenes/mention.mdSupporting file
  • lark-whiteboard/scenes/photo-showcase.mdSupporting file
  • lark-contact/SKILL.mdSupporting file
  • lark-whiteboard/elements/image.mdSupporting file
  • lark-contact/references/lark-contact-search-user.mdSupporting file
  • lark-contact/references/lark-contact-search-bot.mdSupporting file
  • lark-contact/references/lark-contact-get-user.mdSupporting file

Operations mentioned in code and instructions

Read files
SKILL.md:15In the instructionsOpen original file
**CRITICAL：先判断场景，再读取该场景的参考文件；不要在任务开始时一次性读取全部参考文件。每个文件只在首次进入对应阶段时读取一次。**
references/lark-doc-whiteboard.md:43In the instructionsOpen original file
如果 Mermaid 已在本地文件中，可写成 `<whiteboard type="mermaid" path="@./diagram.mmd"></whiteboard>`；CLI 会在写入前读取文件并展开为内联内容。
lark-whiteboard/references/lark-whiteboard-update.md:38In the instructionsOpen original file
# 编写 PlantUML 代码cat > diagram.puml << 'EOF'@startuml
Run commands
references/lark-doc-create-workflow.md:92In the instructionsOpen original file
```bashlark-cli docs +script --command init-draft --presentation-decision '<上方完整 JSON>' --format json
references/lark-doc-create.md:9In the instructionsOpen original file
```bash# 简单内容优先使用 `--content -`，文件导入如下：
references/lark-doc-fetch.md:7In the instructionsOpen original file
```bash# 读取整篇文档，并附带当前用户可见的未解决评论；
Connect to websites
references/lark-doc-create.md:25In the instructionsOpen original file
      "revision_id": 1,      "url": "https://xxx.feishu.cn/docx/docx_token",      "new_blocks": [
references/lark-doc-md.md:63In the instructionsOpen original file
```markdown![alt text](https://example.com/photo.png)```
references/lark-doc-md.md:66In the instructionsOpen original file
- `alt text` 为图片描述（可选，可留空）- URL 支持 `http://` 和 `https://` 协议- 对应的 XML 格式为：`<img href="https://example.com/photo.png"/>`
Install extra software packages
lark-whiteboard/SKILL.md:15In the instructionsOpen original file
> - 运行 `lark-cli --version`，确认可用，无需询问用户。> - 运行 `npx -y @larksuite/whiteboard-cli@^0.2.13 -v`，确认可用，无需询问用户。
lark-whiteboard/references/lark-whiteboard-update.md:78In the instructionsOpen original file
# 使用 whiteboard-cli 生成 OpenAPI 格式并通过管道传递npx -y @larksuite/whiteboard-cli@^0.2.13 -i <产物文件> --to openapi --format json \  | lark-cli whiteboard +update \
lark-whiteboard/references/lark-whiteboard-update.md:92In the instructionsOpen original file
# 生成 OpenAPI 格式到文件npx -y @larksuite/whiteboard-cli@^0.2.13 -i <DSL 文件> --to openapi --format json -o ./temp.json
Lines read
3,559
File checksum (to compare versions)
91be6d85c0417480fdca34fea78cfdb25a0e3a6fb94ccd8d3862225720fc0de1