Skip to content
skillsafebeta
← Report library
Purpose / Documents

Lark Slides Skill Security Audit

What the author says it does (original text)

飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。

Independent security check

Do not install or run it yet

Files checked
191
Risks found
27
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 9
High risk

An instruction to reproduce “historical context losslessly” could disclose prior conversations and internal Skill instructions

Source references: 1
What we found

This behavior is unnecessary for creating or editing slides, yet it directs the agent to reproduce historical context, Skill documentation, and syntax guidance. Historical context may contain private material, credentials, unrelated task data, or internal instructions.

Why this matters

Sensitive conversation content or internal operating rules could appear in a response or presentation and then be exposed to presentation collaborators or external services.

Legitimate use of this code

The candidate overextends the instruction. Although the line mentions “historical context,” it immediately limits the material to the preceding authoritative guidance, required skill documents, and error-prone syntax, and it triggers only on an explicit user request. It does not direct restatement of credentials, private conversations, or other task data, so the claimed high-risk data leak is not supported here.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:43In the instructionsOpen original file
- 绘制图表前必须阅读 [`xml/slides_chart_demo.xml`](references/xml/slides_chart_demo.xml)。- 当用户要求无损复述历史上下文时，必须无损复述以上权威经验、必读的技能文档（需要重新阅读）和易错元素语法（尤其是 `<table>` 和 `<chart>`）。
Medium risk

Local image paths in XML trigger automatic cloud uploads

Source references: 5
What we found

Creation, slide insertion, and whole-page updates recognize `<img src="@...">`, read the referenced file from the current working directory, upload it to the presentation’s media library, and only then submit the page.

Why this matters

If generated XML points to the wrong file, internal screenshots, charts, or other sensitive images in the working directory may be copied into the cloud presentation and exposed to its collaborators.

When page XML explicitly contains an `@` local path, the CLI reads it relative to the command's working directory, uploads it to the target presentation, then submits the slide. This can copy selected local images to the cloud, but only for paths explicitly referenced in XML, and paths are confined to the CWD. The user can prohibit local-image references or request an upload manifest first.

references/cli/lark-slides-add-slide.md:52In the instructionsOpen original file
## 本地图片：`@路径` 占位符XML 里写 `<img src="@./chart.png" .../>`，CLI 会：先把每个不重复的本地文件上传到这份演示文稿（`parent_type=slide_file`），再把 `src` 替换成返回的 `file_token`，最后才提交页面。占位符路径按**执行命令时的 CWD** 解析，跟 `--slide @file` 所在目录无关；`@./assets/x.png` 找的是 `$PWD/assets/x.png`。
Show 4 other places
references/cli/lark-slides-update-slide.md:57In the instructionsOpen original file
## 本地图片：`@路径` 占位符`--content` 的 XML 里写 `<img src="@./chart.png" .../>`，CLI 会：先把每个不重复的本地文件上传到这份演示文稿（`parent_type=slide_file`），再把 `src` 替换成返回的 `file_token`，最后才整页写回。占位符路径按**执行命令时的 CWD** 解析，跟 `--content @file` 所在目录无关；`@./assets/x.png` 找的是 `$PWD/assets/x.png`。
references/cli/lark-slides-add-slide.md:50In the instructionsOpen original file
`@file` 路径**必须在 CWD 内**（如 `@./plan/page3.xml`）；绝对路径和 `../` 会被拒绝并报 `unsafe file path`。
references/cli/lark-slides-add-slide.md:54In the instructionsOpen original file
XML 里写 `<img src="@./chart.png" .../>`，CLI 会：先把每个不重复的本地文件上传到这份演示文稿（`parent_type=slide_file`），再把 `src` 替换成返回的 `file_token`，最后才提交页面。占位符路径按**执行命令时的 CWD** 解析，跟 `--slide @file` 所在目录无关；`@./assets/x.png` 找的是 `$PWD/assets/x.png`。
references/cli/lark-slides-update-slide.md:59In the instructionsOpen original file
`--content` 的 XML 里写 `<img src="@./chart.png" .../>`，CLI 会：先把每个不重复的本地文件上传到这份演示文稿（`parent_type=slide_file`），再把 `src` 替换成返回的 `file_token`，最后才整页写回。占位符路径按**执行命令时的 CWD** 解析，跟 `--content @file` 所在目录无关；`@./assets/x.png` 找的是 `$PWD/assets/x.png`。
Medium risk

Local images are uploaded to Lark, so selecting the wrong file can disclose data

Source references: 6
What we found

The Skill interprets `<img src="@./path">` as a local file and automatically uploads it to the target presentation. Its main workflow also directs remote images to be downloaded locally before upload.

Why this matters

If the agent selects a local image containing confidential, personal, or unlicensed material, its contents enter the presentation’s cloud media store and may become visible to presentation collaborators.

An `@` local path triggers a real cloud upload and places the returned file token in the presentation, so choosing the wrong file could expose its contents to people who can access that deck. This is consistent with creating image-based slides, and paths are confined to the CWD with existence and size checks, but those controls cannot determine whether content is sensitive. The user can require an explicit asset allowlist and confirmation of paths, target deck, and access permissions before upload.

SKILL.md:315In the instructionsOpen original file
7. **编辑已有页面优先原链接更新**：修改单个 shape/img 用 `+replace-slide`（`block_replace` / `block_insert`），不要整页重建；一页改动很多或要改背景用 `+update-slide` 整页覆盖（保 `slide_id` 和页序），多页整页重建就对每页各跑一次 `+update-slide`，不要用 `slides +create` 新建整份 PPT；追加/插入单页用 `+add-slide`、删除单页用 `+delete-slide`，只有这些 shortcut 未覆盖的参数才手动调 `slide.create` / `slide.delete`8. **`<img src>` 只能用上传到飞书 drive 的 `file_token`，禁止使用 http(s) 外链 URL**：飞书 slides 渲染端不会代理外链图片，外链 src 在 PPT 里通常不显示或显示破图。流程必须是「先把图存到本地 → 用 `slides +media-upload` 上传，或在 `+create --slides` 的 XML 里写 `<img src="@./path">` 占位符自动上传 → 拿 `file_token` 写进 `<img src>`」。如果用户给了网图链接，先 `curl`/下载到 CWD 内再走上传流程，不要直接把外链 URL 塞进 `src`。**图片最大 20 MB**（slides upload API 不支持分片上传）。
Show 5 other places
references/cli/lark-slides-create.md:122In the instructionsOpen original file
## 本地图片：`@<path>` 占位符`<img>` 元素的 `src` 属性如果以 `@` 开头，CLI 会把它当作本地文件路径，自动上传到当前演示文稿，并把占位符替换为返回的 `file_token`。
references/cli/lark-slides-media-upload.md:81In the instructionsOpen original file
## 工作原理`+media-upload` 内部调用 `POST /open-apis/drive/v1/medias/upload_all`（单次上传，最大 20 MB），固定使用：- `parent_type=slide_file`（slides 后端唯一接受的取值）- `parent_node=<xml_presentation_id>`
references/cli/lark-slides-create.md:124In the instructionsOpen original file
`<img>` 元素的 `src` 属性如果以 `@` 开头，CLI 会把它当作本地文件路径，自动上传到当前演示文稿，并把占位符替换为返回的 `file_token`。
references/cli/lark-slides-create.md:142In the instructionsOpen original file
- 路径相对于**当前工作目录**（CWD）解析；**必须是 CWD 内的相对路径**（如 `./pic.png`、`./assets/x.png`）- 同一份图被多次引用时**只上传一次**（按路径去重）- `src` 不以 `@` 开头的会原样保留，但**只允许写 `slides +media-upload` 拿到的 `file_token`**；**禁止写 http(s) 外链 URL**：飞书 slides 渲染端不会代理外链图片，外链 src 通常显示破图。要用网图必须先下载到 CWD 内、再走上传流程- 单张图片最大 20 MB（slides upload API 不支持分片上传）- 校验阶段就会检查所有占位符文件存在及大小；缺文件或超限直接报错，不会创建空白 PPT 占位- 创空白 PPT → 上传所有图 → 替换 token → 逐页创建 slide，按这个顺序执行
references/cli/lark-slides-media-upload.md:83In the instructionsOpen original file
`+media-upload` 内部调用 `POST /open-apis/drive/v1/medias/upload_all`（单次上传，最大 20 MB），固定使用：- `parent_type=slide_file`（slides 后端唯一接受的取值）- `parent_node=<xml_presentation_id>`
Medium risk

Local image placeholders upload workspace files to Lark

Source references: 5
What we found

The documentation says `@<local path>` images are automatically uploaded by the CLI and replaced with cloud file tokens. The existing-slide workflow likewise uploads a local file directly.

Why this matters

If the agent selects the wrong file, private screenshots, customer assets, or images containing sensitive information could be uploaded to the presentation and its cloud media storage, inheriting the applicable sharing scope.

When an image `src` uses an `@<local path>` placeholder, the CLI reads and uploads that local image, then replaces the placeholder with a cloud token. This applies only to explicitly referenced images, and paths are restricted to the current working directory. It is consistent with creating image-based slides, but may send a sensitive image to Lark. The user can require a pre-upload file/target/identity confirmation and expose only a non-sensitive working directory.

references/xml/xml-schema-quick-ref.md:226In the instructionsOpen original file
### img```xml<img src="file_token_或_@本地路径" topLeftX="80" topLeftY="120" width="320" height="180"/>````img` 使用 `topLeftX` / `topLeftY`，不是 `x` / `y`。`src` 只支持：`slides +media-upload` 返回的 `file_token`，或 `@<本地路径>` 占位符（`+create --slides` 和 `+add-slide` 会自动上传并替换）。**禁止使用 http(s) 外链 URL**——飞书 slides 渲染端不会代理外链图，外链 src 在 PPT 里通常不显示。本地图片详见 [lark-slides-create.md](../cli/lark-slides-create.md#本地图片path-占位符) / [lark-slides-media-upload.md](../cli/lark-slides-media-upload.md)。本地图片的两种姿势：- 新建带图 PPT：`+create --slides` 里直接写 `src="@./pic.png"`，CLI 在创空白 PPT 后、加 slides 前自动上传并替换 token- 给已有 PPT 加带图新页：`+add-slide --slide` 的 XML 里直接写 `src="@./pic.png"`，CLI 上传后替换 token 再提交页面
Show 4 other places
references/cli/lark-slides-replace-slide.md:180In the instructionsOpen original file
### 给已有页加图（典型场景）```bashPRES_ID=xxxSID=yyy# 1) 上传图片TOKEN=$(lark-cli slides +media-upload --as user \  --file ./pic.png --presentation "$PRES_ID" --jq '.data.file_token')
references/xml/xml-schema-quick-ref.md:228In the instructionsOpen original file
```xml<img src="file_token_或_@本地路径" topLeftX="80" topLeftY="120" width="320" height="180"/>````img` 使用 `topLeftX` / `topLeftY`，不是 `x` / `y`。`src` 只支持：`slides +media-upload` 返回的 `file_token`，或 `@<本地路径>` 占位符（`+create --slides` 和 `+add-slide` 会自动上传并替换）。**禁止使用 http(s) 外链 URL**——飞书 slides 渲染端不会代理外链图，外链 src 在 PPT 里通常不显示。本地图片详见 [lark-slides-create.md](../cli/lark-slides-create.md#本地图片path-占位符) / [lark-slides-media-upload.md](../cli/lark-slides-media-upload.md)。
references/xml/xml-schema-quick-ref.md:236In the instructionsOpen original file
本地图片的两种姿势：- 新建带图 PPT：`+create --slides` 里直接写 `src="@./pic.png"`，CLI 在创空白 PPT 后、加 slides 前自动上传并替换 token- 给已有 PPT 加带图新页：`+add-slide --slide` 的 XML 里直接写 `src="@./pic.png"`，CLI 上传后替换 token 再提交页面
references/cli/lark-slides-create.md:149In the instructionsOpen original file
> [!IMPORTANT]> **路径必须在 CWD 内**：`@/abs/path/x.png` 或 `@../up/x.png` 这种会被 CLI 拒绝（报 `unsafe file path`）。如果素材在别的目录，先 `cd` 过去再执行。
Medium risk

Mandatory image generation or search may disclose presentation topics

Source references: 2
What we found

The Skill does not merely permit images: it forbids image-free delivery and requires the cover image to come from an image-generation or image-search tool. Prompts and queries may include user-provided project, customer, product, or unreleased-plan details.

Why this matters

For a confidential deck, its subject or descriptions may be sent to external image-generation or search services and become subject to their logging and data policies.

What this evidence establishes

The skill mandates many images and specifies generation/search tools for the cover, so sensitive content could lead to descriptive themes being sent to another tool. But the visible source does not establish whether those tools are networked, who operates them, what fields are sent, or whether customer names would be included. The disclosure scope is therefore uncertain. Users can require approved local assets only for sensitive decks.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:21In the instructionsOpen original file
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。- 禁止在 `headline` 或 `title` 下方放置用于分隔或装饰的 `rect` 或 `<line>`。- 禁止在任何页面内部使用无意义的装饰线条或色块条带，页面任何一边都不要使用贴边窄条。- 生图工具的指令参数必须以“不要出现任何文字和颜色色号”结尾，避免生成的图片上出现干扰文字。- 禁止使用 emoji 图标，任何位置都不能出现。
Show 1 other places
SKILL.md:26In the instructionsOpen original file
- 禁止在任何页面内部使用无意义的装饰线条或色块条带，页面任何一边都不要使用贴边窄条。- 生图工具的指令参数必须以“不要出现任何文字和颜色色号”结尾，避免生成的图片上出现干扰文字。- 禁止使用 emoji 图标，任何位置都不能出现。
Medium risk

Mandatory image generation or search may disclose presentation topics

Source references: 2
What we found

The Skill requires the cover image to come from an image-generation or image-search tool and requires many distinct images. Producing relevant assets will commonly require sending slide topics, product names, project descriptions, or other context as prompts or searches.

Why this matters

For a non-public presentation, internal project names, business descriptions, or other confidential subject matter may be exposed to the image provider and become subject to its logging, retention, or training policies.

What this evidence establishes

The rules do require generated/searched cover art and multiple distinct images, which may require describing the slide theme. Yet the evidence does not show the tools' network or retention behavior and does not require sending product names, project descriptions, or sensitive source text. Actual disclosure is therefore unclear. Users can request data-handling details or disable external asset tools for confidential content.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:21In the instructionsOpen original file
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。- 禁止在 `headline` 或 `title` 下方放置用于分隔或装饰的 `rect` 或 `<line>`。
Show 1 other places
SKILL.md:63In the instructionsOpen original file
- 文字卡片：多数页面必须满足 6-8 张文字卡片、200-400 文字数量，字数不足时必须扩写成长句或段落，文字卡片不要留白，必须充实饱满。文字卡片不是短标签，而是“标题 + 完整说明”，像浓缩的分析文稿。文字内容不得不用列表、分栏、关键词或短句时，必须保证层次清晰，更建议拆分为多张子卡片。- 图片卡片：多数页面必须满足 1-3 张图片卡片，缺少图片时必须用生图工具补充配图，图片卡片与文字卡片组成网格，确保图文丰富。- 图表卡片：数据信息不要在文字卡片中罗列，必须在图表卡片中可视化（包括表格、图表、时间线、流程图等），图表卡片与其他卡片组成网格，展现数据驱动。
Medium risk

Mandatory image generation or search may disclose presentation topics to external services

Source references: 2
What we found

The Skill requires image-heavy output, directs cover images to come from generation or search tools, and even specifies text to append to generation prompts. This can cause the agent to construct external image requests from the user's presentation content.

Why this matters

For a deck about an unreleased project, client, financial plan, or internal strategy, prompts or search terms may disclose its topic, keywords, and context. The visible instructions do not require consent, redaction, or avoidance of confidential text.

What this evidence establishes

The rules require images and even prescribe a suffix for image-generation prompts, showing that an image tool may be invoked. But the source does not show the tool implementation, network destination, transmitted content, or privacy policy, and it does not require including the full presentation in prompts. This supports only a conditional disclosure surface, not confirmed transmission. Sensitive tasks can require local or user-provided assets only.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:21In the instructionsOpen original file
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。
Show 1 other places
SKILL.md:26In the instructionsOpen original file
- 禁止在任何页面内部使用无意义的装饰线条或色块条带，页面任何一边都不要使用贴边窄条。- 生图工具的指令参数必须以“不要出现任何文字和颜色色号”结尾，避免生成的图片上出现干扰文字。- 禁止使用 emoji 图标，任何位置都不能出现。
Medium risk

Mandatory image generation or search may disclose presentation topics to external media services

Source references: 3
What we found

The Skill forbids image-free delivery and requires the cover visual to come from an image-generation or image-search tool. Obtaining a relevant image normally requires descriptive prompts or search terms, and the rule provides no exception for confidential presentations.

Why this matters

For unreleased products, customer matters, financial material, or internal strategy, derived prompts or search terms could be processed or logged by an external service. The visible material does not identify the provider or its retention policy.

What this evidence establishes

The skill provides no sensitive-deck exception to its image mandate and requires generated/searched cover art, creating a possibility that descriptive prompts reach another tool. However, the visible evidence does not establish that the tool is an external service or require prompts to contain confidential themes, people, or product names. Users can restrict execution to approved local images or sanitized prompts.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:21In the instructionsOpen original file
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。
Show 2 other places
SKILL.md:26In the instructionsOpen original file
- 禁止在任何页面内部使用无意义的装饰线条或色块条带，页面任何一边都不要使用贴边窄条。- 生图工具的指令参数必须以“不要出现任何文字和颜色色号”结尾，避免生成的图片上出现干扰文字。- 禁止使用 emoji 图标，任何位置都不能出现。
SKILL.md:63In the instructionsOpen original file
- 文字卡片：多数页面必须满足 6-8 张文字卡片、200-400 文字数量，字数不足时必须扩写成长句或段落，文字卡片不要留白，必须充实饱满。文字卡片不是短标签，而是“标题 + 完整说明”，像浓缩的分析文稿。文字内容不得不用列表、分栏、关键词或短句时，必须保证层次清晰，更建议拆分为多张子卡片。- 图片卡片：多数页面必须满足 1-3 张图片卡片，缺少图片时必须用生图工具补充配图，图片卡片与文字卡片组成网格，确保图文丰富。- 图表卡片：数据信息不要在文字卡片中罗列，必须在图表卡片中可视化（包括表格、图表、时间线、流程图等），图表卡片与其他卡片组成网格，展现数据驱动。
Medium risk

Mandatory image generation or search may disclose presentation topics to additional services

Source references: 2
What we found

The Skill requires many images regardless of content sensitivity and specifies that the cover image comes from image-generation or image-search tools. Producing a relevant image normally requires putting topics, people, products, or business scenarios into prompts or search terms.

Why this matters

Non-public product plans, customer information, internal project names, or other presentation content could be received, logged, or processed by an additional image provider.

What this evidence establishes

The mandate for many generated/searched images creates a potential additional data recipient, but the evidence does not describe that recipient, network access, logging/retention, or actual prompt contents. Themes, people, products, or business contexts might be used, but they are not source-mandated transmitted fields. For sensitive decks, users can prohibit external asset tools and use reviewed assets only.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:21In the instructionsOpen original file
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。
Show 1 other places
SKILL.md:26In the instructionsOpen original file
- 禁止在任何页面内部使用无意义的装饰线条或色块条带，页面任何一边都不要使用贴边窄条。- 生图工具的指令参数必须以“不要出现任何文字和颜色色号”结尾，避免生成的图片上出现干扰文字。- 禁止使用 emoji 图标，任何位置都不能出现。
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 6
High risk

Whole-slide updates can delete omitted content and overwrite collaborators’ newer edits

Source references: 5
What we found

`+update-slide` treats submitted XML as the page’s final state: omitted elements and speaker notes are removed. Supplying an old revision is not conflict protection; it rebuilds from the old snapshot and discards later edits.

Why this matters

With incomplete or stale XML, images, text, notes, and changes recently made by collaborators can disappear from the current page.

Whole-slide update has real overwrite and collaboration-loss risk: an old `revision_id` rebuilds from an old snapshot; omitted elements are deleted, and omitting `<note>` clears speaker notes. For “do not write if changed since read,” the documentation requires a fresh read because strict compare-and-swap is unavailable. The user can require block-level replacement or a fresh-read merge.

references/cli/lark-slides-update-slide.md:35In the instructionsOpen original file
| `--content` | 是 | 这一页的完整目标 XML，单一 `<slide>` 根；支持字面量、`@file`、stdin `-`。别名：`--xml` / `--slide-xml` / `--slide-content` / `--content-xml` || `--revision-id` | 否 | 默认 `-1`（最新）。它只选择服务端执行所基于的快照，不是“页面有新编辑就拒绝”的乐观锁；传旧版本号会以旧快照重建页面并丢弃其后的编辑 || `--tid` | 否 | 调用方提供的任务/事务标识，CLI 原样透传；用于关联同一编辑任务或重试，不等同于版本前置条件，不能单独保证并发冲突时拒绝写入。一般留空 |`@file` 和 `+xml-get --output` 一样**只接受当前目录下的相对路径**，绝对路径会被拒。命令别名：`slides +update`（隐藏）；服务别名：`lark-cli slide …` 等价于 `lark-cli slides …`。如果要求“从读取之后页面一旦变化就不再写入”，不能只传 `--revision-id` 或 `--tid`。写入前必须再次用 `+xml-get` 回读最新版，比较读取期间是否发生变化；有变化时先基于最新版重新合并本次修改，再执行整页写回。当前 shortcut 不提供严格的 compare-and-swap 保证。
Show 4 other places
references/cli/lark-slides-update-slide.md:43In the instructionsOpen original file
## 语义：`--content` 就是这一页的最终状态**没写进 `--content` 的东西会从页面上消失。** 这不是补丁，是整页覆盖。| 你在 `--content` 里怎么写 | 页面上的结果 ||---|---|| 元素带原来的 `id` | 按新 XML 更新这个元素 || 元素不带 `id` | 作为新元素插入到它所在的位置 || 原来有、`--content` 里没有的元素 | **删除** || `<style>` 改了 | 背景等页面样式跟着改 || 没写 `<note>` | 讲者备注被清空 |
references/cli/lark-slides-update-slide.md:41In the instructionsOpen original file
如果要求“从读取之后页面一旦变化就不再写入”，不能只传 `--revision-id` 或 `--tid`。写入前必须再次用 `+xml-get` 回读最新版，比较读取期间是否发生变化；有变化时先基于最新版重新合并本次修改，再执行整页写回。当前 shortcut 不提供严格的 compare-and-swap 保证。
references/cli/lark-slides-update-slide.md:45In the instructionsOpen original file
**没写进 `--content` 的东西会从页面上消失。** 这不是补丁，是整页覆盖。
references/cli/lark-slides-update-slide.md:51In the instructionsOpen original file
| 元素不带 `id` | 作为新元素插入到它所在的位置 || 原来有、`--content` 里没有的元素 | **删除** || `<style>` 改了 | 背景等页面样式跟着改 || 没写 `<note>` | 讲者备注被清空 |
Medium risk

Deleting a slide immediately alters the original deck, while recovery depends on available history

Source references: 5
What we found

The command deletes a page in place by slide_id, and the documentation describes the deletion as irreversible in place. Recovery requires separately locating a history version and starting an asynchronous revert.

Why this matters

Selecting the wrong slide_id removes the page from the current presentation. If history is unavailable, misidentified, or the revert fails, the page may not be recoverable.

Deletion removes one slide in place by `slide_id`, and the documentation calls it irreversible; recovery requires separately selecting and reverting a history version. A wrong target therefore has persistent impact. Mitigations include readback, screenshot or dry-run before deletion, plus history rollback; the user can require the target slide to be shown before approval.

references/cli/lark-slides-delete-slide.md:48In the instructionsOpen original file
`slide_id` 是服务端短 ID，**不能从 XML 里推导**。两个来源：1. `+create` / `+add-slide` 的返回值里存下来；2. 事后回读：`slides +xml-get --presentation "$PRES_ID" --output .lark-slides/plan/<deck>/readback.xml`。删错页的代价高于多跑一次回读 —— 不确定就先回读 + `+screenshot` 看一眼再删。## 删错了怎么办删除在原地不可撤销，但可以走历史版本回滚：`+history-list` 找 `history_version_id` → `+history-revert`（只接受 `history_version_id`，不能传 `revision_id`）→ `+history-revert-status` 轮询。命令用法见 [lark-slides-history.md](lark-slides-history.md)。
Show 4 other places
references/cli/lark-slides-delete-slide.md:3In the instructionsOpen original file
从演示文稿删除**一页**，按 `slide_id` 指定。只改一页里的局部内容用 [`+replace-slide`](lark-slides-replace-slide.md)，不要删了重建。
references/cli/lark-slides-delete-slide.md:22In the instructionsOpen original file
# 删之前先确认打到哪份 PPT、哪一页lark-cli slides +delete-slide --presentation "$PRES_ID" --slide-id "$SID" --dry-run```
references/cli/lark-slides-delete-slide.md:53In the instructionsOpen original file
删错页的代价高于多跑一次回读 —— 不确定就先回读 + `+screenshot` 看一眼再删。
references/cli/lark-slides-delete-slide.md:57In the instructionsOpen original file
删除在原地不可撤销，但可以走历史版本回滚：`+history-list` 找 `history_version_id` → `+history-revert`（只接受 `history_version_id`，不能传 `revision_id`）→ `+history-revert-status` 轮询。命令用法见 [lark-slides-history.md](lark-slides-history.md)。
Medium risk

Full-slide updates can delete omitted elements and invalidate comments or links tied to old element IDs

Source references: 4
What we found

`+update-slide` is an overwrite operation: elements omitted from the submitted content are deleted. If IDs are stripped during readback, every element is recreated, silently invalidating comments and direct links anchored to the old IDs.

Why this matters

A major page edit can unintentionally remove images, text, notes, or other elements. Comment locations and element-specific links may also stop working permanently.

This is active overwrite behavior, not merely an example: a full-slide update deletes elements omitted from the submitted XML. If IDs are stripped before writing back, elements are recreated and comments or block links anchored to old IDs silently stop working. It should be used only when the user authorized a full-page rewrite and required elements and IDs are preserved; the user can require a dry run, ID preservation, and post-write readback.

SKILL.md:294In the instructionsOpen original file
| `+media-download` | 根据 Slides 图片 `file_token` 下载本地图片；`--output` 选填，未传时使用 `--output-dir` 默认值 `.lark-slides/media` 并自动生成文件名；调用后使用返回的 `path`，不要猜测实际路径；直连下载无权限时自动回退到源文件预览 || [`+replace-slide`](references/cli/lark-slides-replace-slide.md) | 对已有幻灯片页面进行块级替换/插入（`block_replace` / `block_insert`），自动注入 id 和 `<content/>`，不改变页序 || [`+update-slide`](references/cli/lark-slides-update-slide.md) | 把一整页 XML 交给已有页面，页面变成 `--content` 描述的样子；能一次改样式/插入/删除/备注/背景，`slide_id` 和页序不变。**没写进 `--content` 的元素会被删除** |
Show 3 other places
references/cli/lark-slides-update-slide.md:87In the instructionsOpen original file
先 `--dry-run` 看请求，确认无误再执行。> ⚠️ **第 1 步不要加 `--remove-attr-id`。** 那个参数会把所有元素的 `id` 去掉，再交给 `+update-slide` 的话，每个元素都会被当成新元素插入、原来的全部被删除——页面看起来一样，但所有元素换了新 id，锚在旧 id 上的评论和 block 直达链接全部失效，而且**不会有任何报错**。`--remove-attr-id` 只用于只读查看。
SKILL.md:295In the instructionsOpen original file
| [`+replace-slide`](references/cli/lark-slides-replace-slide.md) | 对已有幻灯片页面进行块级替换/插入（`block_replace` / `block_insert`），自动注入 id 和 `<content/>`，不改变页序 || [`+update-slide`](references/cli/lark-slides-update-slide.md) | 把一整页 XML 交给已有页面，页面变成 `--content` 描述的样子；能一次改样式/插入/删除/备注/背景，`slide_id` 和页序不变。**没写进 `--content` 的元素会被删除** |
references/cli/lark-slides-update-slide.md:89In the instructionsOpen original file
> ⚠️ **第 1 步不要加 `--remove-attr-id`。** 那个参数会把所有元素的 `id` 去掉，再交给 `+update-slide` 的话，每个元素都会被当成新元素插入、原来的全部被删除——页面看起来一样，但所有元素换了新 id，锚在旧 id 上的评论和 block 直达链接全部失效，而且**不会有任何报错**。`--remove-attr-id` 只用于只读查看。
Medium risk

Whole-slide updates or deletion cause persistent cloud-content changes

Source references: 6
What we found

The capability includes deleting and modifying slides. The whole-slide update documentation says a single part carries the entire page and a successful write produces a new revision.

Why this matters

If the presentation, slide ID, or XML selection is wrong, an existing slide may be fully replaced or deleted, affecting collaborators. Atomic execution prevents partial writes, but not a complete yet mistaken overwrite.

The skill's stated scope includes deleting and modifying slides, both of which persistently alter the cloud presentation. Whole-slide update treats XML as final state and deletes omitted elements; slide deletion is irreversible in place. These are normal declared capabilities, but users should require exact targets, readback or dry-run, and prefer block-level replacement for local edits.

SKILL.md:2In the instructionsOpen original file
---name: lark-slidesversion: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 5 other places
references/cli/lark-slides-update-slide.md:144In the instructionsOpen original file
| `data` 下的字段 | 说明 ||------|------|| `xml_presentation_id` | 实际写入的演示文稿 ID || `slide_id` | 与传入相同——整页覆盖不换页 id || `revision_id` | 写入后的新版本号 || `images_uploaded` | 仅当 `--content` 带 `@` 占位符时出现：本次去重后实际上传的图片张数 |服务端拒绝这次写入时（`failed_reason` 非空）**不会**返回成功输出，而是报错并带上原因——单个 part 承载整页，任何失败都意味着页面没被写入。- 原因包含 `not found`：先检查 `--presentation` 和 `--slide-id`，再用 `slides +xml-get` 回读当前页面 ID。页面可能已删除，或 ID 来自另一份演示文稿。- 其他 invalid-parameter 错误：检查 `--content` 中不支持的元素、缺少 `<content/>` 的 `<shape>`，以及超出 960×540 的坐标。
references/cli/lark-slides-replace-slide.md:167In the instructionsOpen original file
| 字段 | 说明 ||------|------|| `xml_presentation_id` | 解析后的真实 token（wiki URL 解析后会变化） || `slide_id` | 与入参一致 || `parts_count` | 本次提交的 parts 条数 || `revision_id` | 成功后的新版本号，下次做乐观锁时用 || `failed_part_index` | 有部分失败时存在，指向第几条 part 失败 || `failed_reason` | 失败原因文字描述 |整批作为原子事务：任一 part 失败则整批不生效，服务端通过 `failed_part_index` / `failed_reason` 告诉你是哪条；按此定位修正后重发。
SKILL.md:4In the instructionsOpen original file
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
references/cli/lark-slides-update-slide.md:43In the instructionsOpen original file
## 语义：`--content` 就是这一页的最终状态**没写进 `--content` 的东西会从页面上消失。** 这不是补丁，是整页覆盖。
references/cli/lark-slides-delete-slide.md:53In the instructionsOpen original file
删错页的代价高于多跑一次回读 —— 不确定就先回读 + `+screenshot` 看一眼再删。## 删错了怎么办删除在原地不可撤销，但可以走历史版本回滚：`+history-list` 找 `history_version_id` → `+history-revert`（只接受 `history_version_id`，不能传 `revision_id`）→ `+history-revert-status` 轮询。命令用法见 [lark-slides-history.md](lark-slides-history.md)。
Medium risk

Block writes can overwrite concurrent edits when version locking is omitted

Source references: 4
What we found

The example directly performs `block_replace`, while revision locking is documented separately as an optional argument. Changing one property requires rewriting the entire element; if someone edits the page after it was read, a write without that read-time `revision_id` may use stale content.

Why this matters

A collaborator's recent title, formatting, or element content could be replaced. The operation runs as the user with slide write permissions.

The example reads a block ID and then performs a whole-block `block_replace` without carrying the read revision, while a separate section shows an optimistic-lock flow that reads and supplies `revision_id`. The lower-level documentation also says even a one-attribute change requires rewriting the whole block. If another person edits that block between read and write, the unlocked example presents a plausible overwrite risk. Users can require the author to always use the revision from the same read and stop on conflicts rather than retrying an overwrite.

references/cli/lark-slides-replace-slide.md:204In the instructionsOpen original file
# block_replace 换掉整个标题块（id 自动注入）lark-cli slides +replace-slide --as user \  --presentation "$PRES_ID" --slide-id "$SID" \  --parts '[{"action":"block_replace","block_id":"bUn","replacement":"<shape type=\"text\" topLeftX=\"80\" topLeftY=\"80\" width=\"800\" height=\"120\"><content textType=\"title\"><p>新标题</p></content></shape>"}]'```
Show 3 other places
references/cli/lark-slides-replace-slide.md:223In the instructionsOpen original file
### 乐观锁```bash# 读时记录 revision_idREV=$(lark-cli slides xml_presentation.slide get --as user \  --params "{\"xml_presentation_id\":\"$PRES_ID\",\"slide_id\":\"$SID\"}" \  --jq '.data.revision_id')# 写时传 --revision-id；传不存在的版本号（超过当前 revision）返回 3350002lark-cli slides +replace-slide --as user \  --presentation "$PRES_ID" --slide-id "$SID" --revision-id "$REV" \  --parts "$PARTS"```
references/cli/lark-slides-xml-presentation-slide-replace.md:178In the instructionsOpen original file
3. **`<img>` 必须用 file_token**：不能用外链 URL——先 [`slides +media-upload`](lark-slides-media-upload.md) 拿 token。4. **不能字段级 patch**：要改一个块的某个属性（比如只改 `topLeftX`），得写整块新 XML 走 `block_replace`；API 不支持"只改一个字段"。5. **`block_replace` 要求 `replacement` 根元素带 `id="<block_id>"`**：底层 API 的硬约束，缺失会返回 3350001。推荐走 shortcut [`+replace-slide`](lark-slides-replace-slide.md)——它会自动把 `id` 注入到 `replacement` 根元素上，用户写 XML 时不用自己加。6. **`<shape>` 必须有 `<content/>` 子元素**：SML 2.0 schema 要求，缺失同样触发 3350001。shortcut [`+replace-slide`](lark-slides-replace-slide.md) 会自动注入 `<content/>`，直接调底层 API 需要自己加。7. **执行前必做**：`lark-cli schema slides.xml_presentation.slide.replace` 查看最新参数结构。
references/cli/lark-slides-replace-slide.md:200In the instructionsOpen original file
```bash# 先拿原页 XML，从里面找到标题块的 3 位 short id（如 bUn）lark-cli slides xml_presentation.slide get --as user \  --params "{\"xml_presentation_id\":\"$PRES_ID\",\"slide_id\":\"$SID\"}"# block_replace 换掉整个标题块（id 自动注入）lark-cli slides +replace-slide --as user \  --presentation "$PRES_ID" --slide-id "$SID" \  --parts '[{"action":"block_replace","block_id":"bUn","replacement":"<shape type=\"text\" topLeftX=\"80\" topLeftY=\"80\" width=\"800\" height=\"120\"><content textType=\"title\"><p>新标题</p></content></shape>"}]'```
Low risk

The Skill can make lasting changes by deleting cloud slide pages

Source references: 5
What we found

Its declared page-management scope explicitly includes deletion and it depends on `lark-cli`, which operates on presentations. The visible instructions do not show a confirmation or backup step before deletion.

Why this matters

If the presentation or page is misidentified, cloud slide content may be deleted; recovery depends on the platform's version history and restore facilities.

Legitimate use of this code

Slide deletion exists, but it is an explicitly declared presentation-management capability, not hidden behavior. The claim that no confirmation or recovery measures are shown is incomplete: the main skill requires readback before deletion, the deletion reference offers dry-run, screenshot review and history rollback, and shared safety rules require confirming user intent before writes/deletes. Users should still verify the exact deck and slide.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructionsOpen original file
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 4 other places
SKILL.md:6In the instructionsOpen original file
metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---
SKILL.md:87In the instructionsOpen original file
| 给已有 PPT 追加或插入页面 | 一次一页，`--slide` 支持 `@file` 绕开 shell 转义 | `slides +add-slide`、`cli/lark-slides-add-slide.md` || 删除页面 | 按 `slide_id` 单页删除，删前先回读确认 | `slides +delete-slide`、`cli/lark-slides-delete-slide.md` || 读取或分析已有 PPT | 解析 slides/wiki token，用 shortcut 回读全文 XML 或读取单页 XML，保存 `xml_presentation_id`、`slide_id`、`revision_id` | `slides +xml-get`、`xml_presentation.slide.get`、`cli/lark-slides-xml-presentations-get.md` |
references/cli/lark-slides-delete-slide.md:53In the instructionsOpen original file
删错页的代价高于多跑一次回读 —— 不确定就先回读 + `+screenshot` 看一眼再删。## 删错了怎么办删除在原地不可撤销，但可以走历史版本回滚：`+history-list` 找 `history_version_id` → `+history-revert`（只接受 `history_version_id`，不能传 `revision_id`）→ `+history-revert-status` 轮询。命令用法见 [lark-slides-history.md](lark-slides-history.md)。
lark-shared/SKILL.md:29In the instructionsOpen original file
2. **写入/删除操作前必须确认用户意图**。3. 目标命令支持 `--dry-run` 时，用 `--dry-run` 预览危险请求。4. **退出码 10 是高风险确认门禁（`risk: "high-risk-write"`），不是错误**：停下 → **向用户确认**（展示 `action`、`risk` 和关键参数）→ 取得**用户显式同意**后，将 `hint` 指出的确认 flag **追加到你原始 argv 的末尾**后重试；**绝不**静默加确认 flag 绕过 → [`lark-shared-high-risk-approval.md`](references/lark-shared-high-risk-approval.md)。
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 7
Medium risk

Bot-created presentations additionally grant management access to the current CLI user

Source references: 3
What we found

When creating as a bot, the CLI also attempts to grant `full_access` to the current CLI user configured on the machine. This is a permission change beyond creating slide content.

Why this matters

If the machine is associated with the wrong account, a shared-device account, or someone who should not manage the resource, that person may receive full management access.

When creating as a bot, the CLI additionally attempts to grant `full_access` to the current CLI user, which is a permission change. However, the main instructions restrict bot identity to explicit user requests or workflows where the bot must own the resource; user identity is the default. The user can require `--as user` or explicitly reject automatic grants before bot creation.

references/cli/lark-slides-create.md:63In the instructionsOpen original file
>> 如果演示文稿是**以应用身份（bot）创建**的，如 `lark-cli slides +create --as bot`，CLI 会**尝试为当前 CLI 用户自动授予该演示文稿的 `full_access`（可管理权限）**。>> 以应用身份创建时，结果里会额外返回 `permission_grant` 字段，明确说明授权结果：> - `status = granted`：当前 CLI 用户已获得该演示文稿的可管理权限> - `status = skipped`：本地没有可用的当前用户 `open_id`，因此不会自动授权> - `status = failed`：演示文稿已创建成功，但自动授权用户失败>
Show 2 other places
SKILL.md:122In the instructionsOpen original file
飞书幻灯片通常是用户自己的内容资源。**默认应优先显式使用 `--as user`（用户身份）执行 slides 相关操作**，始终显式指定身份。- **`--as user`（推荐）**：以当前登录用户身份创建、读取、管理演示文稿。执行前先完成用户授权：
SKILL.md:130In the instructionsOpen original file
- **`--as bot`**：仅在用户明确要求以应用身份操作，或需要让 bot 持有/创建资源时使用。使用 bot 身份时，要额外确认 bot 是否真的有目标演示文稿的访问权限。
Medium risk

Routing by path and token weakens link-origin validation

Source references: 3
What we found

The Skill explicitly sends doubao.com `/slides/` URLs or tokens to this capability and says routing should not depend on the domain. This removes one check on link provenance and target service.

Why this matters

If a user pastes a forged, misleading, or cross-tenant lookalike link, the agent may try to resolve or operate on the wrong target using the current Lark identity. The visible evidence does not show that this has occurred.

What this evidence establishes

The documentation explicitly routes by `/slides/` path/token, including doubao.com, rather than by domain. However, the supplied source does not show URL parsing implementation, an allowlist, redirect handling, or the final API target, so it is unclear whether source validation is actually bypassed. The user can ask how cross-domain URLs are validated and restrict accepted hosts.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:2In the instructionsOpen original file
---name: lark-slidesversion: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 2 other places
SKILL.md:4In the instructionsOpen original file
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
references/cli/lark-slides-add-slide.md:44In the instructionsOpen original file
|------|------|------|| `--presentation` | 是 | `xml_presentation_id`、`/slides/` URL 或 `/wiki/` URL || `--slide` | 是 | 一个完整的 `<slide>...</slide>` 文档；支持字面量、`@file`、stdin `-` || `--before-slide-id` | 否 | 插到该 `slide_id` 之前；**不传就是追加到末尾** || `--revision-id` | 否 | 演示文稿版本号，默认 `-1`（最新）；传具体版本号做乐观锁 |
Medium risk

Link validation accepts SSH, NFS, FTP, and email despite claiming HTTP/HTTPS only

Source references: 5
What we found

The hyperlink documentation says “HTTP/HTTPS only,” but the actual XSD patterns also accept FTP, NFS, SSH, host-like strings, and email addresses. The linter validates against this schema and marks output release-ready whenever there are no errors.

Why this matters

A malicious or mistakenly generated deck may pass validation with links that open external protocols. Clicking one may make the client connect to a network host, launch a protocol handler, or compose email, exposing addressing or host information or causing an unexpected action.

The documentation says hyperlinks support only HTTP/HTTPS, but the actual `href` schema patterns explicitly include FTP, NFS, SSH, host-like strings, and email addresses. The lint path invokes schema validation, while `release_ready` depends only on the error count, so non-web links may pass structural checks and still produce a release-ready result. Whether a client opens them depends on the renderer, but users could wrongly trust the stated link boundary. The author can be asked to restrict links to HTTPS or add a separate protocol safety check.

references/xml/slides_xml_schema_definition.xml:2069In the instructionsOpen original file
    <xs:element name="a">        <xs:annotation>            <xs:documentation>                超链接元素                属性: href (仅支持 http/https)            </xs:documentation>        </xs:annotation>        <xs:complexType mixed="true">            <xs:choice minOccurs="0" maxOccurs="unbounded">                <xs:element ref="sml:br"/>                <xs:element ref="sml:tab"/>                <xs:element ref="sml:formula"/>                <xs:element ref="sml:strong"/>                <xs:element ref="sml:em"/>                <xs:element ref="sml:u"/>                <xs:element ref="sml:span"/>                <xs:element ref="sml:del"/>                <xs:element ref="sml:shadow"/>                <xs:element ref="sml:outline"/>                <xs:element ref="sml:field"/>            </xs:choice>            <xs:attribute name="href" use="required">                <xs:simpleType>                    <xs:restriction base="xs:anyURI">                        <xs:pattern value="(https?|s?ftp|ftps|nfs|ssh)://\S+"/>                        <xs:pattern value="[\w.-]+[.:]\S*"/>                        <xs:pattern value="(mailto:)?\S+@\S+\.\w{2,}"/>                    </xs:restriction>                </xs:simpleType>            </xs:attribute>        </xs:complexType>
Show 4 other places
scripts/xml_lint.py:2813In the codeOpen original file
    namespace_issues = validate_sml_tag_prefixes(xml)    root_name = xml_local_name(root.tag)    sxsd_issues = validate_sxsd_document(xml, root)    iconpark_issues = validate_iconpark_icon_types(root)    top_level_issues = [        normalize_issue(issue, None, {})        for issue in [            *namespace_issues,            *[                issue                for issue in sxsd_issues                if not is_slide_scoped_sxsd_issue(issue, root_name)            ],            *iconpark_issues,        ]    ]
scripts/xml_lint.py:2780In the codeOpen original file
        "summary": {            "slide_count": len(slides),            "error_count": error_count,            "warning_count": warning_count,            "info_count": info_count,            "status": status,            "release_ready": error_count == 0,            "screenshot_review_required": warning_count > 0,        },
references/xml/slides_xml_schema_definition.xml:2090In the instructionsOpen original file
            </xs:choice>            <xs:attribute name="href" use="required">                <xs:simpleType>                    <xs:restriction base="xs:anyURI">                        <xs:pattern value="(https?|s?ftp|ftps|nfs|ssh)://\S+"/>                        <xs:pattern value="[\w.-]+[.:]\S*"/>                        <xs:pattern value="(mailto:)?\S+@\S+\.\w{2,}"/>                    </xs:restriction>                </xs:simpleType>            </xs:attribute>
scripts/xml_lint.py:2779In the codeOpen original file
        "slide_size": slide_size,        "summary": {            "slide_count": len(slides),            "error_count": error_count,            "warning_count": warning_count,            "info_count": info_count,            "status": status,            "release_ready": error_count == 0,            "screenshot_review_required": warning_count > 0,        },
Medium risk

Routing only by URL path and token ignores the domain trust boundary

Source references: 2
What we found

The Skill requires direct activation for doubao.com `/slides/` URLs or tokens and explicitly routes by path pattern and token rather than domain. A string pattern alone does not establish that the link belongs to the expected tenant, service, or resource.

Why this matters

A crafted or accidentally pasted link could be treated as a Lark slide resource and passed to an authenticated `lark-cli`, causing wrong-account access attempts, resource confusion, or a false impression that the domain was trusted and verified.

What this evidence establishes

The source explicitly routes doubao.com `/slides/` URLs/tokens by path and token rather than domain. That establishes the routing policy, but the CLI's host validation, token parsing, and request-target implementation are absent, so it does not prove that an incorrect source would be accepted as a valid Lark resource. Users can restrict hosts and require read-only inspection first.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructionsOpen original file
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 1 other places
SKILL.md:6In the instructionsOpen original file
metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---
Medium risk

Routing relies on path and token while explicitly ignoring the URL domain

Source references: 3
What we found

The Skill directs doubao.com /slides/ URLs or tokens into the Lark Slides workflow and explicitly says routing is not based on the domain. The domain is normally an important boundary for deciding a link's origin and intended service.

Why this matters

A look-alike link supplied by an attacker or misleading content could cause a token from another service to enter the lark-cli workflow, potentially accessing or modifying the wrong account or deck, or exposing the token to an unexpected processing chain. The visible lines do not prove that lark-cli accepts or leaks it.

What this evidence establishes

The visible rule does ignore domain for routing and includes doubao.com `/slides/` forms in the slides workflow. Routing to a skill does not itself establish that the CLI trusts arbitrary hosts or sends credentials to them; that implementation is not provided. Whether the domain boundary is actually bypassed is uncertain. Users can require approved hosts or canonical tokens only.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructionsOpen original file
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 2 other places
SKILL.md:6In the instructionsOpen original file
metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---
references/cli/lark-slides-xml-presentations-get.md:22In the instructionsOpen original file
|------|------|------|------|| `--presentation` | string | 是 | 演示文稿的唯一标识符 || `--revision-id` | integer | 否 | 版本号，`-1` 表示最新版本 || `--output` | string | 否 | XML 保存路径，必须使用相对路径；省略时 XML 在 stdout 的 JSON envelope 中返回 || `--raw` | flag | 否 | 直接把 XML 输出到 stdout，不包 JSON envelope；不能与 `--output`、`--jq` 或非 JSON `--format` 同时使用 |
Medium risk

Routing relies on path and token while explicitly ignoring the URL’s domain boundary

Source references: 2
What we found

The Skill directs the agent to handle doubao.com /slides/ URLs or tokens through the slides capability and explicitly bases routing on the path and token rather than the domain. A path pattern does not establish that a link belongs to the expected Lark service or tenant.

Why this matters

A forged, misleading, or wrong-environment link could cause an account-authorized lark-cli to parse the supplied token and attempt to read or modify the wrong resource. The visible evidence does not establish that such an attempt would succeed.

What this evidence establishes

The candidate accurately cites an active “route without using the domain” instruction, but the supplied documentation does not show whether tokens are canonicalized, validated server-side, or where credentials are sent. Path shape alone is insufficient to authenticate a resource, yet the actual security impact lacks implementation evidence. Users can ask for the host allowlist and canonicalization rules.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructionsOpen original file
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 1 other places
SKILL.md:7In the instructionsOpen original file
  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"
Medium risk

URL routing explicitly ignores the domain, which may apply cloud operations to a token from the wrong source

Source references: 2
What we found

The Skill directs routing based on the `/slides/` path and token and explicitly says the domain is not the basis. A URL shape and token alone do not establish that a link belongs to the intended service, tenant, or presentation.

Why this matters

A mistaken, disguised, or untrusted link could be handed to a CLI with Lark access, causing the wrong cloud presentation to be read or changed; a URL token may also enter a processing path the user did not expect.

What this evidence establishes

The skill does select its workflow by `/slides/` path/token rather than domain. But the supplied source does not show that arbitrary hosts are accepted, how tokens are validated, or whether cloud writes target the URL's host. Thus execution against a wrong-source token is not established. Users can require read-only resolution and display of the canonical resource before any cross-domain write.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructionsOpen original file
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 1 other places
references/cli/lark-slides-delete-slide.md:30In the instructionsOpen original file
|------|------|------|| `--presentation` | 是 | `xml_presentation_id`、`/slides/` URL 或 `/wiki/` URL || `--slide-id` | 是 | 要删除的页面 ID || `--revision-id` | 否 | 演示文稿版本号，默认 `-1`（最新）；传具体版本号做乐观锁 || `--dry-run` | 否 | 打印将要发起的请求，不删除 |
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 3
High risk

Requires a helper to run automatically and out of sight

Source references: 2
What we found

The skill combines automatic execution with instructions not to ask or tell the user.

Why this matters

If the AI follows this text, it may stop following your instructions or skip actions that normally need your approval.

Legitimate use of this code

The cited text requires unsupported checks to be recorded rather than silently omitted. It does not instruct hidden or unapproved execution. Adjacent rules explicitly require user confirmation of each write's exact scope and fresh-read verification afterward.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
lark-drive/references/lark-drive-workflow.md:36In the instructionsOpen original file
3. 事实必须来自可执行 CLI 命令或被引用 skill；不要只凭目录结构推断治理结论。4. 无法执行的检查必须记录到 `unsupported_checks`，不能静默省略。5. 写入前必须产出计划。每一次写入都需要用户对准确范围和 command family 显式确认。
Show 1 other places
lark-drive/references/lark-drive-workflow.md:35In the instructionsOpen original file
2. 在昂贵读取或写入规划前，先解析并确认 `target_scope`。3. 事实必须来自可执行 CLI 命令或被引用 skill；不要只凭目录结构推断治理结论。4. 无法执行的检查必须记录到 `unsupported_checks`，不能静默省略。5. 写入前必须产出计划。每一次写入都需要用户对准确范围和 command family 显式确认。6. CLI/API 支持验证时，写入后必须用 fresh read 验证。7. 结束时进入 `done`，返回已完成事项、验证结果和剩余限制。不要把尚未完成的外部审批描述成已完成。
Medium risk

Instruction to reproduce internal Skill rules may leak implementation guidance

Source references: 1
What we found

The Skill explicitly says that a request for lossless historical-context reproduction must cause it to reread and reproduce its “authoritative experience,” required documents, and error-prone syntax. This is unnecessary for creating or editing slides and may override normal boundaries against revealing internal instructions.

Why this matters

Internal workflow, tool constraints, and implementation details could be placed in chat, slide notes, or another deliverable, helping later prompt-injection attempts or targeted bypasses.

Legitimate use of this code

This instruction triggers only when the user explicitly requests lossless restatement and specifically scopes the output to this skill's authoritative guidance, required documents, and error-prone syntax. It may expose skill implementation notes, but the evidence does not direct disclosure of credentials, other users' data, or system prompts, and the restatement is user-requested.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:43In the instructionsOpen original file
- 绘制图表前必须阅读 [`xml/slides_chart_demo.xml`](references/xml/slides_chart_demo.xml)。- 当用户要求无损复述历史上下文时，必须无损复述以上权威经验、必读的技能文档（需要重新阅读）和易错元素语法（尤其是 `<table>` 和 `<chart>`）。
Low risk

The Skill demands repeated reading and potential reproduction of internal Skill documentation

Source references: 3
What we found

Live instructions require the entire Skill to be read twice and, when a user requests a lossless history recap, require internal rules and syntax documentation to be reread and reproduced. This is unnecessary for slide creation or editing.

Why this matters

It can consume extra context and expose internal operating instructions in user-facing output, crowding out user content or influencing decisions about the current task. The visible evidence does not direct disclosure of credentials.

Legitimate use of this code

Reading the skill document twice adds processing overhead, but the evidence does not direct access to user files, credentials, or extra cloud operations. The restatement condition applies only when the user explicitly requests lossless restatement and is scoped to this skill's design rules, required documents, and syntax. This is redundant workflow guidance, not concealed data behavior.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:13In the instructionsOpen original file
> 本技能文档较长，务必使用 Read 工具阅读两次，必须阅读完整全文。
Show 2 other places
SKILL.md:41In the instructionsOpen original file
- 填充渐变颜色必须用 `<fill><fillColor color="linear-gradient(135deg, rgba(R,G,B,A) 0%, rgba(R,G,B,A) 100%)"/></fill>`。- 编辑页面前必须阅读 [`workflow/slides-editing.md`](references/workflow/slides-editing.md)。- 绘制图表前必须阅读 [`xml/slides_chart_demo.xml`](references/xml/slides_chart_demo.xml)。- 当用户要求无损复述历史上下文时，必须无损复述以上权威经验、必读的技能文档（需要重新阅读）和易错元素语法（尤其是 `<table>` 和 `<chart>`）。
SKILL.md:43In the instructionsOpen original file
- 绘制图表前必须阅读 [`xml/slides_chart_demo.xml`](references/xml/slides_chart_demo.xml)。- 当用户要求无损复述历史上下文时，必须无损复述以上权威经验、必读的技能文档（需要重新阅读）和易错元素语法（尤其是 `<table>` 和 `<chart>`）。
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

A generated “close-enough” logo can cause brand misidentification

Source references: 2
What we found

The asset-planning example explicitly recommends creating a “close-enough” image when a real customer logo is unavailable. The visible rule does not require marking that substitute as fictional or pending replacement.

Why this matters

Customers, executives, or external viewers may mistake the synthetic mark for an authentic brand identity, causing false attribution, improper brand use, or reduced trust in commercial materials.

Asset planning requires a fallback for each planned asset, and the listed “Good examples” explicitly tells the system to generate a “close-enough image” instead of a real customer logo. The visible rule does not require marking that image as fictional, a placeholder, or pending replacement; by contrast, the adjacent chart example explicitly requires a simulated-data label. This could cause viewers to mistake an approximation for an authentic brand mark. Users can restrict the skill to authorized real assets, plain-text names, or clearly labeled placeholders instead of generated lookalike logos.

references/planning-layer.md:207In the instructionsOpen original file
`asset_need` is metadata. It can describe a desired figure, diagram, chart, icon, logo, screenshot, or fallback visual.Use an object for one planned asset, an array for multiple real needs, or `asset_type: "none"` when no asset is useful. Each planned asset must include:- `asset_type`: one of `paper_figure`, `architecture_diagram`, `icon`, `logo`, `chart`, `infographic`, `screenshot`, `flow_diagram`, or `none`.- `purpose`: why this asset helps the page's key message.- `suggested_query`: short future lookup hint only; do not execute it unless separately requested.- `fallback_if_missing`: a plan to create a close-enough image with the image generation tool, or a native `<chart>` for data.- `chart_contract`: when `asset_type` is `chart` and the visual is a supported standard data chart, set this optional slide-level field so generation is locked to native `<chart>`.
Show 1 other places
references/planning-layer.md:219In the instructionsOpen original file
Good examples:- `{"asset_type":"architecture_diagram","purpose":"Explain component relationships.","suggested_query":"service architecture diagram","fallback_if_missing":"Render the component diagram with <shape> + <line>."}`- `{"asset_type":"logo","purpose":"Identify the customer context.","suggested_query":"customer logo","fallback_if_missing":"Create a close-enough image with the image generation tool instead of a real logo."}`- `{"asset_type":"chart","purpose":"Show adoption trend.","suggested_query":"monthly adoption trend chart","fallback_if_missing":"Render a native `<chart>` using the provided series when available; otherwise render a native `<chart>` with mock placeholder values and label it as 模拟数据，仅占位，待替换真实数据."}`
Low risk

The Skill generates mock chart data when real values are absent

Source references: 1
What we found

The planning rules require mock data when the user requests trends, comparisons, distributions, or other data expression without supplying concrete values, while requiring clear labeling.

Why this matters

If the placeholder label is cropped or removed during later editing, export, or screenshots, viewers may mistake fabricated values for real business data and make decisions from them.

If the user requests charts, trends, comparisons, or distributions without supplying values, the rules generate mock or placeholder data instead of pausing for real figures. Clear labeling is required, so this is not covert fabrication, but it could still affect decisions if the label is missed or the deck is treated as factual. The user can prohibit mock data, require confirmation of values first, or require prominent example labels in both the chart and speaker notes.

references/planning-layer.md:143In the instructionsOpen original file
`data_source` must be one of:- `user_provided`: the user supplied concrete values, tables, CSV, or metric lists; use them and do not replace them with mock data.- `mock_placeholder`: the user asked for a placeholder, template, example, or later-replaceable chart position; use mock data in native `<chart>`.- `mock_required_by_intent`: the user did not provide concrete values but asked for data expression, charts, trends, comparisons, or distributions; use mock data in native `<chart>`.`data_series_required` means the generated XML must include `<chartData>`. It does not require user-provided real-world values. When real values are unavailable but chart expression is part of the user's intent, write mock or placeholder values into native `<chart>` and label them clearly instead of switching to manual drawing primitives or metric blocks.

Inside this skill

8 instruction sections

The Skill uses lark-cli to create, read, edit, and delete Lark Slides as either a user or an application. It defaults to an explicitly selected user identity and requires a login authorization flow.

View source
SKILL.md:122In the instructionsOpen original file
飞书幻灯片通常是用户自己的内容资源。**默认应优先显式使用 `--as user`（用户身份）执行 slides 相关操作**，始终显式指定身份。- **`--as user`（推荐）**：以当前登录用户身份创建、读取、管理演示文稿。执行前先完成用户授权：```bashlark-cli auth login --domain slides```
SKILL.md:134In the instructionsOpen original file
1. 创建、读取、增删 slide、按用户给出的链接继续编辑已有 PPT，默认都先用 `--as user`。2. 如果出现权限不足，先检查当前是否误用了 bot 身份；不要默认回退到 bot。3. 只有在用户明确要求"用应用身份 / bot 身份操作"，或当前工作流就是 bot 创建资源后再做协作授权时，才切换到 `--as bot`。

For creation or major rewrites, it stores a plan and XML locally, runs a local lint step, writes the content to the cloud, and reads it back for verification. The plan is intentionally retained after success.

View source
SKILL.md:104In the instructionsOpen original file
**CRITICAL — 新建演示文稿或大幅改写页面时，MUST 先生成 `.lark-slides/plan/<deck-or-task-id>/slide_plan.json`，再生成 XML。先创建对应目录，规划层规则和中间产物生命周期见 [planning-layer.md](references/planning-layer.md)。仅替换一个标题、插入一个块等小型已有页编辑可豁免。****CRITICAL — 新建演示文稿或大幅改写页面时，生成 XML 前 MUST 读取 [visual-planning.md](references/visual-planning.md)，确保 `layout_type`、`visual_focus`、`text_density` 实际改变页面几何、主视觉和文本量。****CRITICAL — 新建演示文稿或大幅改写页面时，规划 `asset_need` MUST 遵循 [asset-planning.md](references/asset-planning.md)：只做元数据规划，必须有 `fallback_if_missing`，不得要求真实搜索、下载或上传素材。****CRITICAL — 将完整 `<slide>` XML 提交给 `slides +create`、`slides +add-slide` 或 `slides +update-slide` 之前，MUST 先把待提交 XML 保存到本地文件并运行唯一版式准出入口 [`scripts/xml_lint.py`](scripts/xml_lint.py)；`summary.error_count` 必须为 0 才能调用接口。**
references/planning-layer.md:36In the instructionsOpen original file
`.lark-slides/` is local agent state. It supports recovery, iteration, and later edits, but it should not be treated as source code or committed by default.Keep:- `.lark-slides/plan/<deck-or-task-id>/slide_plan.json` after successful creation or major rewrite. The plan is the editable design state for the deck.- A small manifest when useful for follow-up work, such as `xml_presentation_id`, slide IDs, `revision_id`, plan path, and verification status.
references/workflow/validation-xml.md:9In the instructionsOpen original file
1. 记录创建或编辑返回的 `xml_presentation_id`，以及已知的 `slide_id` / `revision_id`。2. 用 `slides +xml-get` 回读全文 XML 到本地文件。3. 检查实际页数是否符合计划或用户要求。4. 检查每页 `<data>` 内是否有预期主要元素。5. 检查没有明显空白页、破损页、缺失标题或缺失主视觉。6. 检查页面不是全部退化为标题加 bullet list。7. 检查视觉层级：标题、主视觉、支撑信息三者可区分。8. 检查明显溢出和布局风险：重叠、越界、底部拥挤、长文本框。9. 在最终回复中给出简短验证记录。

Multi-page creation is not atomic. If it fails partway through, the presentation and successfully added pages remain, and the workflow calls for reading the current state before recovery.

View source
references/cli/lark-slides-create.md:18In the instructionsOpen original file
> [!IMPORTANT]> `slides +create` 带页面时底层会逐页创建，不是原子操作。中途失败时先记录 `xml_presentation_id`，回读确认当前状态，再继续修复或追加。**CRITICAL — 提交前必须先跑版式 lint**：把待提交的 `<slide>` XML 存成本地文件，运行 [`scripts/xml_lint.py`](../../scripts/xml_lint.py)，`summary.error_count` 必须为 0。
references/cli/lark-slides-create.md:58In the instructionsOpen original file
> [!IMPORTANT]> 不带页面参数时，`slides +create` 只创建空白演示文稿。创建后用 [`+add-slide`](lark-slides-add-slide.md) 逐页添加 slide 内容。>> 带了页面时，CLI 先创建空白演示文稿，再逐页调用 slide 创建接口添加页面。如果某一页添加失败，CLI 会停止并报错，已创建的演示文稿和已添加的页面会保留。>> 如果演示文稿是**以应用身份（bot）创建**的，如 `lark-cli slides +create --as bot`，CLI 会**尝试为当前 CLI 用户自动授予该演示文稿的 `full_access`（可管理权限）**。>

The Skill uses lark-cli to read, create, and edit Lark slides, supporting both block-level replacement and full-slide overwrite.

View source
SKILL.md:283In the instructionsOpen original file
Shortcut 是对常用操作的高级封装（`lark-cli slides +<verb> [flags]`）。有 Shortcut 的操作优先使用。| Shortcut | 说明 ||----------|------|| [`+create`](references/cli/lark-slides-create.md) | 创建 PPT，可选一步添加页面 || [`+add-slide`](references/cli/lark-slides-add-slide.md) | 向已有演示文稿追加或插入**一页**（`--before-slide-id` 控制位置），XML 支持 `@file` / stdin，`<img src="@./path">` 占位符自动上传 || [`+delete-slide`](references/cli/lark-slides-delete-slide.md) | 按 `slide_id` 删除**一页** || [`+xml-get`](references/cli/lark-slides-xml-presentations-get.md) | 读取全文 XML，用 `--presentation` 指定演示文稿的 `xml_presentation_id`，用 `--output` 把 XML 存到本地文件（必须是 CWD 内的相对路径，如 `.lark-slides/plan/<deck>/readback.xml`） || [`+screenshot`](references/cli/lark-slides-screenshot.md) | 把幻灯片页面截图保存为本地图片；用 `--slide-number` 指定页码（从 1 开始，多页重复传入）或用 `--slide-id` 指定页面；单张用 `--output .lark-slides/screenshots/<deck-or-task-id>/page-01`，批量用 `--output-dir .lark-slides/screenshots/<deck-or-task-id>`（一次最多 10 页）；后续必须读取返回的 `output` / `screenshots[].path` || [`+media-upload`](references/cli/lark-slides-media-upload.md) | 上传本地图片到指定演示文稿，返回 `file_token`（用作 `<img src="...">`），最大 20 MB || `+media-download` | 根据 Slides 图片 `file_token` 下载本地图片；`--output` 选填，未传时使用 `--output-dir` 默认值 `.lark-slides/media` 并自动生成文件名；调用后使用返回的 `path`，不要猜测实际路径；直连下载无权限时自动回退到源文件预览 || [`+replace-slide`](references/cli/lark-slides-replace-slide.md) | 对已有幻灯片页面进行块级替换/插入（`block_replace` / `block_insert`），自动注入 id 和 `<content/>`，不改变页序 || [`+update-slide`](references/cli/lark-slides-update-slide.md) | 把一整页 XML 交给已有页面，页面变成 `--content` 描述的样子；能一次改样式/插入/删除/备注/背景，`slide_id` 和页序不变。**没写进 `--content` 的元素会被删除** |

For creation or major rewrites, the Skill writes planning, XML readback, and screenshot artifacts under the current working directory and requires a full presentation readback after cloud writes.

View source
SKILL.md:308In the instructionsOpen original file
1. **先规划再写 XML**：新建演示文稿或大幅改写页面时，必须先写入 `.lark-slides/plan/<deck-or-task-id>/slide_plan.json`；模板、风格和大纲只能作为规划输入，不能绕过规划层2. **创建流程**：新建演示文稿用 `slides +create`，一步创建还是两步创建按 [`cli/lark-slides-create.md`](references/cli/lark-slides-create.md) 判断3. **`<slide>` 直接子元素只有 `<style>`、`<data>`、`<note>`**：文本和图形必须放在 `<data>` 内4. **文本通过 `<content>` 表达**：必须用 `<content><p>...</p></content>`，不能把文字直接写在 shape 内；不要混淆 XML 元素 `<content>` 和 `--parts` 的 JSON 字段：编写 `--parts` 时，`block_replace` 装载 XML 使用标准字段 `replacement`，`block_insert` 使用 `insertion`5. **保存关键 ID**：后续操作需要 `xml_presentation_id`、`slide_id`、`revision_id`6. **删除谨慎**：删除不可逆，删前先回读确认 `slide_id`7. **编辑已有页面优先原链接更新**：修改单个 shape/img 用 `+replace-slide`（`block_replace` / `block_insert`），不要整页重建；一页改动很多或要改背景用 `+update-slide` 整页覆盖（保 `slide_id` 和页序），多页整页重建就对每页各跑一次 `+update-slide`，不要用 `slides +create` 新建整份 PPT；追加/插入单页用 `+add-slide`、删除单页用 `+delete-slide`，只有这些 shortcut 未覆盖的参数才手动调 `slide.create` / `slide.delete`8. **`<img src>` 只能用上传到飞书 drive 的 `file_token`，禁止使用 http(s) 外链 URL**：飞书 slides 渲染端不会代理外链图片，外链 src 在 PPT 里通常不显示或显示破图。流程必须是「先把图存到本地 → 用 `slides +media-upload` 上传，或在 `+create --slides` 的 XML 里写 `<img src="@./path">` 占位符自动上传 → 拿 `file_token` 写进 `<img src>`」。如果用户给了网图链接，先 `curl`/下载到 CWD 内再走上传流程，不要直接把外链 URL 塞进 `src`。**图片最大 20 MB**（slides upload API 不支持分片上传）。
SKILL.md:219In the instructionsOpen original file
Step 4: 审查 & 交付  - 创建完成后，必须用 `slides +xml-get --presentation <xml_presentation_id>` 读取全文 XML，并按 workflow/validation-xml.md 做显式验证记录，包括 XML 文本重叠检查  - 失败或部分成功按 workflow/error-handling.md 处理；局部问题优先用 `+replace-slide` 修正  - 没问题 → 交付：使用 NotifyHuman 工具交付 PPT 链接```

The image workflow uploads selected local images into the target presentation’s media store; image paths are restricted to the current working directory and each image is limited to 20 MB.

View source
references/cli/lark-slides-create.md:122In the instructionsOpen original file
## 本地图片：`@<path>` 占位符`<img>` 元素的 `src` 属性如果以 `@` 开头，CLI 会把它当作本地文件路径，自动上传到当前演示文稿，并把占位符替换为返回的 `file_token`。`slide-01.xml`：```xml<slide xmlns="https://www.larkoffice.com/sml/2.0">  <data>    <img src="@./assets/chart.png" topLeftX="100" topLeftY="100" width="320" height="180"/>  </data></slide>``````bashlark-cli slides +create --as user --title "图测试" --slide @./slide-01.xml```行为：- 路径相对于**当前工作目录**（CWD）解析；**必须是 CWD 内的相对路径**（如 `./pic.png`、`./assets/x.png`）- 同一份图被多次引用时**只上传一次**（按路径去重）- `src` 不以 `@` 开头的会原样保留，但**只允许写 `slides +media-upload` 拿到的 `file_token`**；**禁止写 http(s) 外链 URL**：飞书 slides 渲染端不会代理外链图片，外链 src 通常显示破图。要用网图必须先下载到 CWD 内、再走上传流程- 单张图片最大 20 MB（slides upload API 不支持分片上传）- 校验阶段就会检查所有占位符文件存在及大小；缺文件或超限直接报错，不会创建空白 PPT 占位- 创空白 PPT → 上传所有图 → 替换 token → 逐页创建 slide，按这个顺序执行

The Skill claims to create, read, and edit Lark presentations, including creating, deleting, reading, and partially replacing slides; it can therefore perform cloud writes when the user requests edits to an existing deck.

View source
SKILL.md:2In the instructionsOpen original file
---name: lark-slidesversion: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:

Operations depend on a locally installed lark-cli and invoke Slides APIs as the user. Creating a presentation requires create/write scopes, while editing, Wiki links, and local images may additionally require update, Wiki-read, and media-upload permissions.

View source
SKILL.md:5In the instructionsOpen original file
description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---
references/cli/lark-slides-create.md:168In the instructionsOpen original file
| 错误码 | 含义 | 解决方案 ||--------|------|----------|| 400 | 参数错误 | 检查参数格式是否正确 || 403 | 权限不足 | 检查是否拥有 `slides:presentation:create` 和 `slides:presentation:write_only` scope |
references/cli/lark-slides-update-slide.md:160In the instructionsOpen original file
|------|------|------|| 3350001，原因包含 `not found` | `--presentation` 不匹配，或 `--slide-id` 对应的页面已被删除 | 检查 `--presentation` 和 `--slide-id`，再用 `slides +xml-get` 回读当前页面 ID || 3350001，其他 invalid param | `--content` 的 XML 结构有问题（如 `<shape>` 缺 `<content/>`、包含服务端不支持的元素） | 按 [error-handling.md](../workflow/error-handling.md) 检查 `--content` 的 XML 结构 || 3350002 not found | `--revision-id` 传了不存在的版本号 | 用 `-1` 或真实存在的 `revision_id` || 1061004 / 403 | 当前身份对这份 PPT 没有编辑权限 | 检查是否拥有 `slides:presentation:update` 或 `slides:presentation:write_only` scope；wiki 链接另需 `wiki:node:read`，`@` 占位符另需 `docs:document.media:upload`；`--as bot` 还要求该 bot 对目标 PPT 有编辑权限 |

The Skill includes local static XML validation for structure, icons, text overflow, occlusion, and canvas bounds. The visible code reads a local schema and icon index; the provided excerpts do not show the validator itself making network requests or reading credentials.

View source
scripts/xml_lint.py:316In the codeOpen original file
def load_sxsd_tag_attributes() -> dict[str, set[str]]:    global _SXSD_TAG_ATTRIBUTES_CACHE    if _SXSD_TAG_ATTRIBUTES_CACHE is not None:        return _SXSD_TAG_ATTRIBUTES_CACHE    _SXSD_TAG_ATTRIBUTES_CACHE = sxsd_validator.load_tag_attributes(SXSD_SCHEMA_PATH)    return _SXSD_TAG_ATTRIBUTES_CACHEdef load_iconpark_icon_types() -> set[str]:    global _ICONPARK_ICON_TYPES_CACHE    if _ICONPARK_ICON_TYPES_CACHE is not None:        return _ICONPARK_ICON_TYPES_CACHE    try:        index_data = json.loads(ICONPARK_INDEX_PATH.read_text(encoding="utf-8"))    except json.JSONDecodeError as error:        fail(f"invalid iconpark index JSON: {error}")    icons = index_data.get("icons")    if not isinstance(icons, list):        fail("iconpark index must contain an icons array")    icon_types = {        icon["iconType"]        for icon in icons        if isinstance(icon, dict) and isinstance(icon.get("iconType"), str) and icon["iconType"]    }    _ICONPARK_ICON_TYPES_CACHE = icon_types    return icon_types
scripts/xml_lint.py:1045In the codeOpen original file
def detect_image_text_occlusions(elements: list[dict[str, Any]]) -> list[dict[str, Any]]:    issues: list[dict[str, Any]] = []    text_elements = [        element        for element in elements        if is_text_element(element) and has_text_content(element) and not is_ghost_text(element)    ]    image_elements = [element for element in elements if element["kind"] == "img" and element["alpha"] > 0]    for text_element in text_elements:        for image_element in image_elements:            if image_element["order"] <= text_element["order"]:                continue            if is_vertical_text(text_element):                if intersects(image_element, text_element):                    issues.append({                        "level": "info",                        "code": "image_may_cover_vertical_text",                        "elements": [element_ref(image_element), element_ref(text_element)],                        "message": (                            f"image {element_label(image_element)} may cover vertical text shape "                            f"{element_label(text_element)}"                        ),                        "hint": "Inspect the rendered slide because vertical text layout is not statically modeled.",                    })                continue            text_visual_bbox = estimate_text_visual_bbox(text_element)            if text_visual_bbox is not None and intersects(image_element, text_visual_bbox):                issues.append({                    "level": "error",                    "code": "image_covers_text",                    "elements": [element_ref(image_element), element_ref(text_element)],                    "message": (                        f"image {element_label(image_element)} covers text shape "                        f"{element_label(text_element)}"                    ),                    "hint": "Move the image before the text shape in XML order, or adjust the image and text shape coordinates or dimensions.",                })    return issues

After creation, the workflow calls for reading the presentation back and checking slides and assets; it also explicitly forbids claiming human visual acceptance based only on static XML checks.

View source
references/asset-planning.md:130In the instructionsOpen original file
When generating XML:1. If an asset exists and the workflow supports it, place it in the planned visual region.2. If no asset exists, immediately render `fallback_if_missing` with the planned generated close-enough image. Supported standard data visuals still use native `<chart>`; other fallbacks may use the image generation tool to create an approximate image.3. Size the fallback to satisfy `visual_focus`; it should be a real page element, not a tiny decoration.4. Keep text-density limits. Do not compensate for missing assets by adding long bullet text.5. After creation, fetch the presentation and verify asset pages are not blank and that each planned fallback is visible when no real asset was used.6. If the image generation tool is unavailable or fails, degrade to an XML-native fallback instead of leaving a blank: native `<chart>` for data, otherwise a simple in-card shape/text placeholder sized to fill `visual_focus`.
references/workflow/validation-xml.md:146In the instructionsOpen original file
最终回复必须包含简短验证记录，建议格式：```text验证记录：- 回读：已执行 slides +xml-get，实际页数 N / 预期 N。- 关键页：架构解释 / Self-Attention / 对比或演进 / 总结页均存在。- 结构：检查了主要 shape/img/table/chart 元素，无明显空白页或破损页。- 布局：检查了标题层级、主视觉、重叠/越界/文本溢出风险。```不要声称完成了人工视觉验收，除非确实打开或获取了可视化结果。仅从 XML 静态检查得出的结论，应表述为“静态检查未发现明显问题”。

The Skill claims to create, read, and edit Lark slides and depends on a locally installed `lark-cli`.

View source
SKILL.md:2In the instructionsOpen original file
---name: lark-slidesversion: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---

The replacement examples write to a specified presentation as the user; a block replacement replaces the whole target element rather than one attribute.

View source
references/cli/lark-slides-replace-slide.md:204In the instructionsOpen original file
# block_replace 换掉整个标题块（id 自动注入）lark-cli slides +replace-slide --as user \  --presentation "$PRES_ID" --slide-id "$SID" \  --parts '[{"action":"block_replace","block_id":"bUn","replacement":"<shape type=\"text\" topLeftX=\"80\" topLeftY=\"80\" width=\"800\" height=\"120\"><content textType=\"title\"><p>新标题</p></content></shape>"}]'```
references/cli/lark-slides-xml-presentation-slide-replace.md:178In the instructionsOpen original file
3. **`<img>` 必须用 file_token**：不能用外链 URL——先 [`slides +media-upload`](lark-slides-media-upload.md) 拿 token。4. **不能字段级 patch**：要改一个块的某个属性（比如只改 `topLeftX`），得写整块新 XML 走 `block_replace`；API 不支持"只改一个字段"。5. **`block_replace` 要求 `replacement` 根元素带 `id="<block_id>"`**：底层 API 的硬约束，缺失会返回 3350001。推荐走 shortcut [`+replace-slide`](lark-slides-replace-slide.md)——它会自动把 `id` 注入到 `replacement` 根元素上，用户写 XML 时不用自己加。6. **`<shape>` 必须有 `<content/>` 子元素**：SML 2.0 schema 要求，缺失同样触发 3350001。shortcut [`+replace-slide`](lark-slides-replace-slide.md) 会自动注入 `<content/>`，直接调底层 API 需要自己加。7. **执行前必做**：`lark-cli schema slides.xml_presentation.slide.replace` 查看最新参数结构。
Start here · InstructionsSKILL.md
lark-slides
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.

File reference map

References: 40
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records191 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • scripts/iconpark_tool_test.pyFull text included
  • scripts/iconpark_tool.pyFull text included
  • scripts/sxsd_validator.pyFull text included
  • scripts/xml_lint_test.pyFull text included
  • scripts/xml_lint.pyFull text included
  • scripts/xml_text_overlap_lint_test.pyFull text included
  • scripts/xml_text_overlap_lint.pyFull text included
  • references/asset-planning.mdFull text included
  • references/cli/lark-slides-add-slide.mdFull text included
  • references/cli/lark-slides-create.mdFull text included
  • references/cli/lark-slides-delete-slide.mdFull text included
  • references/cli/lark-slides-history.mdFull text included
  • references/cli/lark-slides-media-upload.mdFull text included
  • references/cli/lark-slides-replace-slide.mdFull text included
  • references/cli/lark-slides-screenshot.mdFull text included
  • references/cli/lark-slides-update-slide.mdFull text included
  • references/cli/lark-slides-xml-presentations-get.mdFull text included
  • references/planning-layer.mdFull text included
  • references/visual-planning.mdFull text included
  • references/workflow/error-handling.mdFull text included
  • references/workflow/slides-editing.mdFull text included
  • references/workflow/template-editing.mdFull text included
  • references/workflow/validation-xml.mdFull text included
  • references/xml/iconpark.mdFull text included
  • references/xml/slides_chart_demo.xmlFull text included
  • references/xml/slides_xml_schema_definition.xmlFull text included
  • references/xml/xml-schema-quick-ref.mdFull text included
  • lark-contact/references/lark-contact-get-user.mdFull text included
  • lark-contact/references/lark-contact-search-bot.mdFull text included
  • lark-contact/references/lark-contact-search-user.mdFull text included
  • lark-doc/references/genres/business-analysis.mdFull text included
  • lark-doc/references/genres/data-report.mdFull text included
  • lark-doc/references/genres/email.mdFull text included
  • lark-doc/references/genres/execution-plan.mdFull text included
  • lark-doc/references/genres/formal-doc.mdFull text included
  • lark-doc/references/genres/meeting-minutes.mdFull text included
  • lark-doc/references/genres/memo-brief.mdFull text included
  • lark-doc/references/genres/official-redhead.mdFull text included
  • lark-doc/references/genres/prd.mdFull text included
  • lark-doc/references/genres/proposal.mdFull text included
  • lark-doc/references/genres/research-report.mdFull text included
  • lark-doc/references/genres/retrospective.mdFull text included
  • lark-doc/references/genres/route-consumer.mdFull text included
  • lark-doc/references/genres/route-creative.mdFull text included
  • lark-doc/references/genres/route-knowledge.mdFull text included
  • lark-doc/references/genres/route-marketing.mdFull text included
  • lark-doc/references/genres/route-media.mdFull text included
  • lark-doc/references/genres/route-opinion.mdFull text included
  • lark-doc/references/genres/route-personal-brand.mdFull text included
  • lark-doc/references/genres/route-platform.mdFull text included
  • lark-doc/references/genres/route-report.mdFull text included
  • lark-doc/references/genres/route-workplace.mdFull text included
  • lark-doc/references/genres/sop-tutorial.mdFull text included
  • lark-doc/references/genres/technical-doc.mdFull text included
  • lark-doc/references/genres/wechat.mdFull text included
  • lark-doc/references/genres/weekly-report.mdFull text included
  • lark-doc/references/genres/white-paper.mdFull text included
  • lark-doc/references/genres/xiaohongshu.mdFull text included
  • lark-doc/references/lark-doc-create-workflow.mdFull text included
  • lark-doc/references/lark-doc-create.mdFull text included
  • lark-doc/references/lark-doc-fetch.mdFull text included
  • lark-doc/references/lark-doc-history.mdFull text included
  • lark-doc/references/lark-doc-md.mdFull text included
  • lark-doc/references/lark-doc-media-download.mdFull text included
  • lark-doc/references/lark-doc-media-insert.mdFull text included
  • lark-doc/references/lark-doc-media-preview.mdFull text included
  • lark-doc/references/lark-doc-mindnote.mdFull text included
  • lark-doc/references/lark-doc-resource-cover.mdFull text included
  • lark-doc/references/lark-doc-script.mdFull text included
  • lark-doc/references/lark-doc-update.mdFull text included
  • lark-doc/references/lark-doc-whiteboard.mdFull text included
  • lark-doc/references/lark-doc-xml-extended-blocks.mdFull text included
  • lark-doc/references/lark-doc-xml.mdFull text included
  • lark-doc/SKILL.mdFull text included
  • lark-drive/references/lark-drive-add-comment.mdFull text included
  • lark-drive/references/lark-drive-add-reply.mdFull text included
  • lark-drive/references/lark-drive-apply-permission.mdFull text included
  • lark-drive/references/lark-drive-batch-query-comments.mdFull text included
  • lark-drive/references/lark-drive-comment-content.mdFull text included
  • lark-drive/references/lark-drive-comment-location.mdFull text included
  • lark-drive/references/lark-drive-copy.mdFull text included
  • lark-drive/references/lark-drive-cover.mdFull text included
  • lark-drive/references/lark-drive-create-folder.mdFull text included
  • lark-drive/references/lark-drive-create-shortcut.mdFull text included
  • lark-drive/references/lark-drive-delete-reply.mdFull text included
  • lark-drive/references/lark-drive-delete.mdFull text included
  • lark-drive/references/lark-drive-download.mdFull text included
  • lark-drive/references/lark-drive-export-download.mdFull text included
  • lark-drive/references/lark-drive-export.mdFull text included
  • lark-drive/references/lark-drive-files-list.mdFull text included
  • lark-drive/references/lark-drive-import.mdFull text included
  • lark-drive/references/lark-drive-inspect.mdFull text included
  • lark-drive/references/lark-drive-list-comments.mdFull text included
  • lark-drive/references/lark-drive-list-replies.mdFull text included
  • lark-drive/references/lark-drive-member-add.mdFull text included
  • lark-drive/references/lark-drive-member-list.mdFull text included
  • lark-drive/references/lark-drive-member-remove.mdFull text included
  • lark-drive/references/lark-drive-move.mdFull text included
  • lark-drive/references/lark-drive-permission-get-setting.mdFull text included
  • lark-drive/references/lark-drive-permission-guide.mdFull text included
  • lark-drive/references/lark-drive-preview.mdFull text included
  • lark-drive/references/lark-drive-pull.mdFull text included
  • lark-drive/references/lark-drive-push.mdFull text included
  • lark-drive/references/lark-drive-react-reply.mdFull text included
  • lark-drive/references/lark-drive-reactions.mdFull text included
  • lark-drive/references/lark-drive-resolve-comment.mdFull text included
  • lark-drive/references/lark-drive-restore-comment.mdFull text included
  • lark-drive/references/lark-drive-search.mdFull text included
  • lark-drive/references/lark-drive-secure-label.mdFull text included
  • lark-drive/references/lark-drive-status.mdFull text included
  • lark-drive/references/lark-drive-task-result.mdFull text included
  • lark-drive/references/lark-drive-update-reply.mdFull text included
  • lark-drive/references/lark-drive-update-title.mdFull text included
  • lark-drive/references/lark-drive-upload.mdFull text included
  • lark-drive/references/lark-drive-version-delete.mdFull text included
  • lark-drive/references/lark-drive-version-get.mdFull text included
  • lark-drive/references/lark-drive-version-history.mdFull text included
  • lark-drive/references/lark-drive-version-revert.mdFull text included
  • lark-drive/references/lark-drive-workflow-knowledge-organize-analysis.mdFull text included
  • lark-drive/references/lark-drive-workflow-knowledge-organize-discovery.mdFull text included
  • lark-drive/references/lark-drive-workflow-knowledge-organize-execution.mdFull text included
  • lark-drive/references/lark-drive-workflow-knowledge-organize-planning.mdFull text included
  • lark-drive/references/lark-drive-workflow-knowledge-organize-rollback.mdFull text included
  • lark-drive/references/lark-drive-workflow-knowledge-organize.mdFull text included
  • lark-drive/references/lark-drive-workflow-permission-governance-commands.mdFull text included
  • lark-drive/references/lark-drive-workflow-permission-governance-outputs.mdFull text included
  • lark-drive/references/lark-drive-workflow-permission-governance.mdFull text included
  • lark-drive/references/lark-drive-workflow-topic-move-collector-execute.mdFull text included
  • lark-drive/references/lark-drive-workflow-topic-move-collector-recall.mdFull text included
  • lark-drive/references/lark-drive-workflow-topic-move-collector-resolve-verify.mdFull text included
  • lark-drive/references/lark-drive-workflow-topic-move-collector-review-plan.mdFull text included
  • lark-drive/references/lark-drive-workflow-topic-move-collector-setup.mdFull text included
  • lark-drive/references/lark-drive-workflow-topic-move-collector.mdFull text included
  • lark-drive/references/lark-drive-workflow.mdFull text included
  • lark-drive/SKILL.mdFull text included
  • lark-shared/references/lark-shared-config-init.mdFull text included
  • lark-shared/references/lark-shared-high-risk-approval.mdFull text included
  • lark-shared/references/lark-shared-identity-and-permissions.mdFull text included
  • lark-shared/references/lark-shared-output-contract.mdFull text included
  • lark-shared/references/lark-shared-update-notice.mdFull text included
  • lark-shared/references/lark-wiki-token-routing.mdFull text included
  • lark-shared/SKILL.mdFull text included
  • lark-whiteboard/elements/image.mdFull text included
  • lark-whiteboard/references/lark-whiteboard-export.mdFull text included
  • lark-whiteboard/references/lark-whiteboard-update.mdFull text included
  • lark-whiteboard/references/lark-whiteboard-workflow.mdFull text included
  • lark-whiteboard/routes/dsl.mdFull text included
  • lark-whiteboard/routes/mermaid.mdFull text included
  • lark-whiteboard/routes/svg-edit.mdFull text included
  • lark-whiteboard/routes/svg.mdFull text included
  • lark-whiteboard/scenes/mention.mdFull text included
  • lark-whiteboard/scenes/photo-showcase.mdFull text included
  • lark-whiteboard/SKILL.mdFull text included
  • lark-wiki/references/lark-wiki-delete-space.mdFull text included
  • lark-wiki/references/lark-wiki-member-add.mdFull text included
  • lark-wiki/references/lark-wiki-member-list.mdFull text included
  • lark-wiki/references/lark-wiki-member-remove.mdFull text included
  • lark-wiki/references/lark-wiki-move-to-drive.mdFull text included
  • lark-wiki/references/lark-wiki-move.mdFull text included
  • lark-wiki/references/lark-wiki-node-copy.mdFull text included
  • lark-wiki/references/lark-wiki-node-create.mdFull text included
  • lark-wiki/references/lark-wiki-node-delete.mdFull text included
  • lark-wiki/references/lark-wiki-node-get.mdFull text included
  • lark-wiki/references/lark-wiki-node-list.mdFull text included
  • lark-wiki/references/lark-wiki-space-create.mdFull text included
  • lark-wiki/references/lark-wiki-space-list.mdFull text included
  • lark-wiki/SKILL.mdFull text included
  • references/cli/lark-slides-xml-presentation-slide-get.mdFull text included
  • references/cli/lark-slides-xml-presentation-slide-replace.mdFull text included
  • references/xml/iconpark-index.jsonFull text included
  • lark-contact/SKILL.mdFull text included
  • references/iconpark-index.jsonFull text included
  • references/iconpark.mdFull text included
  • references/lark-slides-add-slide.mdFull text included
  • references/lark-slides-create.mdFull text included
  • references/lark-slides-delete-slide.mdFull text included
  • references/lark-slides-edit-workflows.mdFull text included
  • references/lark-slides-history.mdFull text included
  • references/lark-slides-media-upload.mdFull text included
  • references/lark-slides-pptx-template-workflows.mdFull text included
  • references/lark-slides-replace-slide.mdFull text included
  • references/lark-slides-screenshot.mdFull text included
  • references/lark-slides-xml-presentation-slide-get.mdFull text included
  • references/lark-slides-xml-presentation-slide-replace.mdFull text included
  • references/lark-slides-xml-presentations-get.mdFull text included
  • references/slides_chart_demo.xmlFull text included
  • references/slides_xml_schema_definition.xmlFull text included
  • references/troubleshooting.mdFull text included
  • references/validation-checklist.mdFull text included
  • references/xml-schema-quick-ref.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/asset-planning.mdSupporting file
  • references/cli/lark-slides-add-slide.mdSupporting file
  • references/cli/lark-slides-create.mdSupporting file
  • references/cli/lark-slides-delete-slide.mdSupporting file
  • references/cli/lark-slides-history.mdSupporting file
  • references/cli/lark-slides-media-upload.mdSupporting file
  • references/cli/lark-slides-replace-slide.mdSupporting file
  • references/cli/lark-slides-screenshot.mdSupporting file
  • references/cli/lark-slides-update-slide.mdSupporting file
  • references/cli/lark-slides-xml-presentation-slide-get.mdSupporting file
  • references/cli/lark-slides-xml-presentation-slide-replace.mdSupporting file
  • references/cli/lark-slides-xml-presentations-get.mdSupporting file
  • references/iconpark-index.jsonSupporting file
  • references/iconpark.mdSupporting file
  • references/lark-slides-add-slide.mdSupporting file
  • references/lark-slides-create.mdSupporting file
  • references/lark-slides-delete-slide.mdSupporting file
  • references/lark-slides-edit-workflows.mdSupporting file
  • references/lark-slides-history.mdSupporting file
  • references/lark-slides-media-upload.mdSupporting file
  • references/lark-slides-pptx-template-workflows.mdSupporting file
  • references/lark-slides-replace-slide.mdSupporting file
  • references/lark-slides-screenshot.mdSupporting file
  • references/lark-slides-xml-presentation-slide-get.mdSupporting file
  • references/lark-slides-xml-presentation-slide-replace.mdSupporting file
  • references/lark-slides-xml-presentations-get.mdSupporting file
  • references/planning-layer.mdSupporting file
  • references/slides_chart_demo.xmlSupporting file
  • references/slides_xml_schema_definition.xmlSupporting file
  • references/troubleshooting.mdSupporting file
  • references/validation-checklist.mdSupporting file
  • references/visual-planning.mdSupporting file
  • references/workflow/error-handling.mdSupporting file
  • references/workflow/slides-editing.mdSupporting file
  • references/workflow/template-editing.mdSupporting file
  • references/workflow/validation-xml.mdSupporting file
  • references/xml-schema-quick-ref.mdSupporting file
  • references/xml/iconpark-index.jsonSupporting file
  • references/xml/iconpark.mdSupporting file
  • references/xml/slides_chart_demo.xmlSupporting file
  • references/xml/slides_xml_schema_definition.xmlSupporting file
  • references/xml/xml-schema-quick-ref.mdSupporting file
  • scripts/iconpark_tool.pyScript
  • scripts/iconpark_tool_test.pyScript
  • scripts/sxsd_validator.pyScript
  • scripts/xml_lint.pyScript
  • scripts/xml_lint_test.pyScript
  • scripts/xml_text_overlap_lint.pyScript
  • scripts/xml_text_overlap_lint_test.pyScript
  • lark-drive/SKILL.mdSupporting file
  • lark-drive/references/lark-drive-copy.mdSupporting file
  • lark-drive/references/lark-drive-search.mdSupporting file
  • lark-drive/references/lark-drive-inspect.mdSupporting file
  • lark-drive/references/lark-drive-workflow.mdSupporting file
  • lark-drive/references/lark-drive-workflow-permission-governance.mdSupporting file
  • lark-drive/references/lark-drive-member-remove.mdSupporting file
  • lark-drive/references/lark-drive-secure-label.mdSupporting file
  • lark-drive/references/lark-drive-workflow-topic-move-collector.mdSupporting file
  • lark-drive/references/lark-drive-workflow-knowledge-organize.mdSupporting file
  • lark-drive/references/lark-drive-comment-location.mdSupporting file
  • lark-drive/references/lark-drive-export.mdSupporting file
  • lark-drive/references/lark-drive-update-title.mdSupporting file
  • lark-drive/references/lark-drive-permission-guide.mdSupporting file
  • lark-drive/references/lark-drive-permission-get-setting.mdSupporting file
  • lark-drive/references/lark-drive-apply-permission.mdSupporting file
  • lark-drive/references/lark-drive-upload.mdSupporting file
  • lark-drive/references/lark-drive-create-folder.mdSupporting file
  • lark-drive/references/lark-drive-download.mdSupporting file
  • lark-drive/references/lark-drive-preview.mdSupporting file
  • lark-drive/references/lark-drive-cover.mdSupporting file
  • lark-drive/references/lark-drive-status.mdSupporting file
  • lark-drive/references/lark-drive-pull.mdSupporting file
  • lark-drive/references/lark-drive-push.mdSupporting file
  • lark-drive/references/lark-drive-create-shortcut.mdSupporting file
  • lark-drive/references/lark-drive-add-comment.mdSupporting file
  • lark-drive/references/lark-drive-list-comments.mdSupporting file
  • lark-drive/references/lark-drive-batch-query-comments.mdSupporting file
  • lark-drive/references/lark-drive-resolve-comment.mdSupporting file
  • lark-drive/references/lark-drive-restore-comment.mdSupporting file
  • lark-drive/references/lark-drive-add-reply.mdSupporting file
  • lark-drive/references/lark-drive-list-replies.mdSupporting file
  • lark-drive/references/lark-drive-update-reply.mdSupporting file
  • lark-drive/references/lark-drive-delete-reply.mdSupporting file
  • lark-drive/references/lark-drive-react-reply.mdSupporting file
  • lark-drive/references/lark-drive-export-download.mdSupporting file
  • lark-drive/references/lark-drive-import.mdSupporting file
  • lark-drive/references/lark-drive-version-history.mdSupporting file
  • lark-drive/references/lark-drive-version-get.mdSupporting file
  • lark-drive/references/lark-drive-version-revert.mdSupporting file
  • lark-drive/references/lark-drive-version-delete.mdSupporting file
  • lark-drive/references/lark-drive-move.mdSupporting file
  • lark-drive/references/lark-drive-delete.mdSupporting file
  • lark-drive/references/lark-drive-task-result.mdSupporting file
  • lark-drive/references/lark-drive-member-add.mdSupporting file
  • lark-drive/references/lark-drive-member-list.mdSupporting file
  • lark-drive/references/lark-drive-files-list.mdSupporting file
  • lark-wiki/SKILL.mdSupporting file
  • lark-shared/SKILL.mdSupporting file
  • lark-doc/SKILL.mdSupporting file
  • lark-wiki/references/lark-wiki-node-copy.mdSupporting file
  • lark-shared/references/lark-wiki-token-routing.mdSupporting file
  • lark-drive/references/lark-drive-workflow-permission-governance-commands.mdSupporting file
  • lark-wiki/references/lark-wiki-node-list.mdSupporting file
  • lark-drive/references/lark-drive-workflow-permission-governance-outputs.mdSupporting file
  • lark-doc/references/lark-doc-fetch.mdSupporting file
  • lark-drive/references/lark-drive-workflow-topic-move-collector-setup.mdSupporting file
  • lark-drive/references/lark-drive-workflow-topic-move-collector-recall.mdSupporting file
  • lark-drive/references/lark-drive-workflow-topic-move-collector-resolve-verify.mdSupporting file
  • lark-drive/references/lark-drive-workflow-topic-move-collector-review-plan.mdSupporting file
  • lark-drive/references/lark-drive-workflow-topic-move-collector-execute.mdSupporting file
  • lark-wiki/references/lark-wiki-move.mdSupporting file
  • lark-wiki/references/lark-wiki-move-to-drive.mdSupporting file
  • lark-wiki/references/lark-wiki-node-create.mdSupporting file
  • lark-wiki/references/lark-wiki-node-delete.mdSupporting file
  • lark-drive/references/lark-drive-workflow-knowledge-organize-discovery.mdSupporting file
  • lark-drive/references/lark-drive-workflow-knowledge-organize-analysis.mdSupporting file
  • lark-drive/references/lark-drive-workflow-knowledge-organize-planning.mdSupporting file
  • lark-drive/references/lark-drive-workflow-knowledge-organize-execution.mdSupporting file
  • lark-drive/references/lark-drive-workflow-knowledge-organize-rollback.mdSupporting file
  • lark-wiki/references/lark-wiki-node-get.mdSupporting file
  • lark-drive/references/lark-drive-comment-content.mdSupporting file
  • lark-drive/references/lark-drive-reactions.mdSupporting file
  • lark-wiki/references/lark-wiki-delete-space.mdSupporting file
  • lark-wiki/references/lark-wiki-space-list.mdSupporting file
  • lark-wiki/references/lark-wiki-space-create.mdSupporting file
  • lark-wiki/references/lark-wiki-member-add.mdSupporting file
  • lark-wiki/references/lark-wiki-member-remove.mdSupporting file
  • lark-wiki/references/lark-wiki-member-list.mdSupporting file
  • lark-shared/references/lark-shared-identity-and-permissions.mdSupporting file
  • lark-shared/references/lark-shared-output-contract.mdSupporting file
  • lark-shared/references/lark-shared-high-risk-approval.mdSupporting file
  • lark-shared/references/lark-shared-config-init.mdSupporting file
  • lark-shared/references/lark-shared-update-notice.mdSupporting file
  • lark-doc/references/lark-doc-create-workflow.mdSupporting file
  • lark-doc/references/lark-doc-create.mdSupporting file
  • lark-doc/references/lark-doc-update.mdSupporting file
  • lark-doc/references/lark-doc-script.mdSupporting file
  • lark-doc/references/lark-doc-history.mdSupporting file
  • lark-doc/references/lark-doc-media-insert.mdSupporting file
  • lark-doc/references/lark-doc-media-preview.mdSupporting file
  • lark-doc/references/lark-doc-media-download.mdSupporting file
  • lark-doc/references/lark-doc-resource-cover.mdSupporting file
  • lark-doc/references/lark-doc-whiteboard.mdSupporting file
  • lark-doc/references/lark-doc-mindnote.mdSupporting file
  • lark-whiteboard/SKILL.mdSupporting file
  • lark-whiteboard/references/lark-whiteboard-update.mdSupporting file
  • lark-doc/references/genres/route-workplace.mdSupporting file
  • lark-doc/references/genres/route-report.mdSupporting file
  • lark-doc/references/genres/route-knowledge.mdSupporting file
  • lark-doc/references/genres/route-media.mdSupporting file
  • lark-doc/references/genres/route-opinion.mdSupporting file
  • lark-doc/references/genres/route-consumer.mdSupporting file
  • lark-doc/references/genres/route-marketing.mdSupporting file
  • lark-doc/references/genres/route-personal-brand.mdSupporting file
  • lark-doc/references/genres/route-creative.mdSupporting file
  • lark-doc/references/genres/route-platform.mdSupporting file
  • lark-doc/references/lark-doc-xml.mdSupporting file
  • lark-doc/references/lark-doc-xml-extended-blocks.mdSupporting file
  • lark-doc/references/lark-doc-md.mdSupporting file
  • lark-whiteboard/references/lark-whiteboard-export.mdSupporting file
  • lark-whiteboard/routes/svg-edit.mdSupporting file
  • lark-whiteboard/references/lark-whiteboard-workflow.mdSupporting file
  • lark-doc/references/genres/memo-brief.mdSupporting file
  • lark-doc/references/genres/weekly-report.mdSupporting file
  • lark-doc/references/genres/proposal.mdSupporting file
  • lark-doc/references/genres/execution-plan.mdSupporting file
  • lark-doc/references/genres/formal-doc.mdSupporting file
  • lark-doc/references/genres/official-redhead.mdSupporting file
  • lark-doc/references/genres/meeting-minutes.mdSupporting file
  • lark-doc/references/genres/retrospective.mdSupporting file
  • lark-doc/references/genres/prd.mdSupporting file
  • lark-doc/references/genres/technical-doc.mdSupporting file
  • lark-doc/references/genres/sop-tutorial.mdSupporting file
  • lark-doc/references/genres/research-report.mdSupporting file
  • lark-doc/references/genres/data-report.mdSupporting file
  • lark-doc/references/genres/white-paper.mdSupporting file
  • lark-doc/references/genres/business-analysis.mdSupporting file
  • lark-doc/references/genres/xiaohongshu.mdSupporting file
  • lark-doc/references/genres/wechat.mdSupporting file
  • lark-doc/references/genres/email.mdSupporting file
  • lark-whiteboard/routes/svg.mdSupporting file
  • lark-whiteboard/routes/dsl.mdSupporting file
  • lark-whiteboard/routes/mermaid.mdSupporting file
  • lark-whiteboard/scenes/mention.mdSupporting file
  • lark-whiteboard/scenes/photo-showcase.mdSupporting file
  • lark-contact/SKILL.mdSupporting file
  • lark-whiteboard/elements/image.mdSupporting file
  • lark-contact/references/lark-contact-search-user.mdSupporting file
  • lark-contact/references/lark-contact-search-bot.mdSupporting file
  • lark-contact/references/lark-contact-get-user.mdSupporting file

Operations mentioned in code and instructions

Run commands
scripts/iconpark_tool_test.py:6In the codeOpen original file
import jsonimport subprocessimport sys
scripts/iconpark_tool_test.py:120In the codeOpen original file
class IconParkToolCLITest(unittest.TestCase):    def run_tool(self, *args: str) -> subprocess.CompletedProcess[str]:        return subprocess.run(
scripts/iconpark_tool_test.py:121In the codeOpen original file
    def run_tool(self, *args: str) -> subprocess.CompletedProcess[str]:        return subprocess.run(            [sys.executable, str(SCRIPT_PATH), *args],
Connect to websites
scripts/sxsd_validator.py:18In the codeOpen original file
XS_NS = "{http://www.w3.org/2001/XMLSchema}"SML_NAMESPACE = "https://www.larkoffice.com/sml/2.0"
scripts/sxsd_validator.py:19In the codeOpen original file
XS_NS = "{http://www.w3.org/2001/XMLSchema}"SML_NAMESPACE = "https://www.larkoffice.com/sml/2.0"SML_LEGACY_HTTP_NAMESPACE = "http://www.larkoffice.com/sml/2.0"
scripts/sxsd_validator.py:20In the codeOpen original file
SML_NAMESPACE = "https://www.larkoffice.com/sml/2.0"SML_LEGACY_HTTP_NAMESPACE = "http://www.larkoffice.com/sml/2.0"SML_READBACK_NAMESPACE = "/sml/2.0"
Read files
scripts/iconpark_tool.py:152In the codeOpen original file
    try:        index_data = json.loads(index_path.read_text(encoding="utf-8"))    except json.JSONDecodeError as error:
scripts/xml_lint.py:88In the codeOpen original file
def read_file(file_path: str | Path) -> str:    return Path(file_path).read_text(encoding="utf-8")
scripts/xml_lint.py:89In the codeOpen original file
def read_file(file_path: str | Path) -> str:    return Path(file_path).read_text(encoding="utf-8")
Change files
scripts/xml_lint_test.py:60In the codeOpen original file
            requested_path = temp_path / "requested.xml"            resolved_path.write_text(                '<presentation xmlns="https://www.larkoffice.com/sml/2.0" width="960" height="540">'
scripts/xml_lint_test.py:86In the codeOpen original file
            input_path = Path(temp_dir) / "invalid-slide.xml"            input_path.write_text(                """
scripts/xml_lint_test.py:3161In the codeOpen original file
                    input_path = Path(temp_dir) / f"{name}.xml"                    input_path.write_text(                        f"""
Install extra software packages
lark-whiteboard/SKILL.md:15In the instructionsOpen original file
> - 运行 `lark-cli --version`，确认可用，无需询问用户。> - 运行 `npx -y @larksuite/whiteboard-cli@^0.2.13 -v`，确认可用，无需询问用户。
lark-whiteboard/references/lark-whiteboard-update.md:78In the instructionsOpen original file
# 使用 whiteboard-cli 生成 OpenAPI 格式并通过管道传递npx -y @larksuite/whiteboard-cli@^0.2.13 -i <产物文件> --to openapi --format json \  | lark-cli whiteboard +update \
lark-whiteboard/references/lark-whiteboard-update.md:92In the instructionsOpen original file
# 生成 OpenAPI 格式到文件npx -y @larksuite/whiteboard-cli@^0.2.13 -i <DSL 文件> --to openapi --format json -o ./temp.json
Lines read
69,183
File checksum (to compare versions)
fdc94905b795893ecb60b28c254525556b82b5131d898a6816897646eb21ec25