Skip to content
skillsafebeta
← Report library
Purpose / Documents

Lark Slides Skill Security Audit

What the author says it does (original text)

飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。

Independent security check

Do not install or run it yet

Files checked
50
Risks found
20
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 7
High risk

The “lossless historical-context restatement” rule may expose credentials, private content, and internal instructions

Source references: 1
What we found

The Skill explicitly requires a complete restatement of historical context on request and includes rereading Skill documentation in that restatement. History may contain unrelated task data, private documents, access tokens, or internal instructions, with no restriction to user-approved slide content.

Why this matters

It could reveal sensitive information unrelated to the slide task and expose internal rules that control the agent.

Legitimate use of this code

This line does not direct the agent to reproduce every conversation, credential, or private document. When the user explicitly requests a lossless restatement, it requires inclusion of this Skill's listed guidance, required documents, and syntax. The visible text does not support the claimed disclosure of tokens, system instructions, or unrelated task content.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:43In the instructions
- 绘制图表前必须阅读 [`xml/slides_chart_demo.xml`](references/xml/slides_chart_demo.xml)。- 当用户要求无损复述历史上下文时，必须无损复述以上权威经验、必读的技能文档（需要重新阅读）和易错元素语法（尤其是 `<table>` 和 `<chart>`）。
Medium risk

Local PPTX files and images are uploaded to Lark cloud storage

Source references: 4
What we found

The template workflow imports a local PPTX, and the media workflow uploads selected local files into the target presentation's Drive media library. Path restrictions keep selection within the working directory, but the content still leaves the device.

Why this matters

If a template or image contains customer material, internal screenshots, personal information, or hidden metadata, it is copied into the Lark account and becomes subject to the presentation's sharing permissions.

These are expected operations for the Skill, but they actively move local content to the cloud: a supplied PPTX is imported as Lark Slides, and selected images are uploaded to the presentation's Drive media library. Restricting paths to the working directory does not prevent sensitive-data disclosure. Only explicitly approved files should be selected, with the destination tenant, deck, and access scope confirmed for confidential or licensed material.

references/workflow/template-editing.md:7In the instructions
如果用户提供的模板是 PPTX 格式，先把模板导入成 Lark Slides。后续写入目标是导入后的 Slides，不是新建一个脱离模板的 deck，也不是先在本地重画 PPTX 再导入。直接使用以下命令，不需要先加载 `lark-drive` Skill：```bashlark-cli drive +import --as user --file "<template.pptx>" --type slides --json```
Show 3 other places
references/cli/lark-slides-media-upload.md:1In the instructions
# slides +media-upload（上传本地图片到飞书幻灯片）把本地图片上传到指定演示文稿的 drive 媒体库，返回 `file_token`。**返回的 token 作为 `<img src="...">` 的值塞进 slide XML 即可显示图片。**
references/cli/lark-slides-media-upload.md:46In the instructions
|------|------|------|| `--file` | 是 | 本地图片路径，**必须是 CWD 内的相对路径**（如 `./pic.png`）。**最大 20 MB**（slides upload API 不支持分片上传）。**仅支持 png / jpeg / gif / bmp / tiff / webp** || `--presentation` | 是 | `xml_presentation_id`、`/slides/<token>` URL，或 `/wiki/<token>` URL |> [!IMPORTANT]> **路径必须在 CWD 内**：`--file /abs/path/x.png` 或 `--file ../up/x.png` 会被 CLI 拒绝（报 `unsafe file path`）。如果素材在别的目录，先 `cd` 过去再执行。
references/cli/lark-slides-media-upload.md:44In the instructions
| 参数 | 必填 | 说明 ||------|------|------|| `--file` | 是 | 本地图片路径，**必须是 CWD 内的相对路径**（如 `./pic.png`）。**最大 20 MB**（slides upload API 不支持分片上传）。**仅支持 png / jpeg / gif / bmp / tiff / webp** || `--presentation` | 是 | `xml_presentation_id`、`/slides/<token>` URL，或 `/wiki/<token>` URL |
Medium risk

Local images are automatically uploaded to the user's Lark presentation

Source references: 4
What we found

An image source beginning with `@` causes the CLI to read and upload that local file to the presentation. The Skill also mandates extensive image use, which can broaden uploads even when the user requested only text or structural changes.

Why this matters

Selected image contents leave the device and enter Lark media storage. If a whole-slide replacement fails after upload, the media remains; a direct retry can upload another copy, leaving orphaned or duplicate cloud data.

This risk applies conditionally: the CLI reads and uploads a local file only when an `<img src>` in the generated or edited XML starts with `@`. The Skill mandates many non-repeated images, which could increase the number of local assets selected, but the evidence does not show scanning or uploading unreferenced files. A user can require an approved asset list and a dry run showing every upload path.

SKILL.md:21In the instructions
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。- 禁止在 `headline` 或 `title` 下方放置用于分隔或装饰的 `rect` 或 `<line>`。
Show 3 other places
references/cli/lark-slides-create.md:122In the instructions
## 本地图片：`@<path>` 占位符`<img>` 元素的 `src` 属性如果以 `@` 开头，CLI 会把它当作本地文件路径，自动上传到当前演示文稿，并把占位符替换为返回的 `file_token`。
references/cli/lark-slides-create.md:142In the instructions
- 路径相对于**当前工作目录**（CWD）解析；**必须是 CWD 内的相对路径**（如 `./pic.png`、`./assets/x.png`）- 同一份图被多次引用时**只上传一次**（按路径去重）- `src` 不以 `@` 开头的会原样保留，但**只允许写 `slides +media-upload` 拿到的 `file_token`**；**禁止写 http(s) 外链 URL**：飞书 slides 渲染端不会代理外链图片，外链 src 通常显示破图。要用网图必须先下载到 CWD 内、再走上传流程- 单张图片最大 20 MB（slides upload API 不支持分片上传）- 校验阶段就会检查所有占位符文件存在及大小；缺文件或超限直接报错，不会创建空白 PPT 占位- 创空白 PPT → 上传所有图 → 替换 token → 逐页创建 slide，按这个顺序执行
references/cli/lark-slides-update-slide.md:70In the instructions
- 文件不存在、不是普通文件、超过 20 MB，都在**调用任何接口之前**报错，不会留下半成品。- 去重只在**单次调用内**生效：多页共用同一张图时，逐页更新会把它每页重传一次。这种图先用 [`+media-upload`](lark-slides-media-upload.md) 传一次，把 `file_token` 写进各页的 `src`。- 整页只发一个 part，所以上传是这条命令里**唯一不可逆的一半**：图先落进演示文稿的 media store，若随后 replace 失败，报错 hint 会告诉你已经传了几张，直接重试会再传一份。先 `--dry-run` 可提前看到 `images_to_upload` 和上传步骤。
Medium risk

doubao.com slide URLs or tokens are forcibly routed into the Lark workflow

Source references: 2
What we found

The Skill explicitly routes by the `/slides/` path and token even for doubao.com, while the workflow depends on lark-cli. The supplied evidence does not establish token compatibility or where such a token is sent.

Why this matters

If the token belongs to another service or carries access authority, misrouting could expose it to an unintended CLI, logs, or Lark account workflow, or target the wrong resource.

What this evidence establishes

The description does route doubao.com URLs with a `/slides/` path or token into the Lark Slides flow, which depends on `lark-cli`. However, the supplied source does not show the CLI invocation, token handling, or destination server, so it cannot establish that a Doubao token is sent to Lark, is compatible, or is exposed. A user can ask the author to document token parsing boundaries, recipients, and the basis for cross-domain compatibility, and restrict unconfirmed token submission.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructions
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 1 other places
SKILL.md:7In the instructions
  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"
Medium risk

Local image paths in slide XML are automatically uploaded to the cloud

Source references: 3
What we found

The Skill supports `@<local path>` in image sources, and the CLI automatically uploads those files and replaces the paths with file tokens when creating or adding slides. The main instructions also insist on extensive image use.

Why this matters

If the agent selects the wrong path or treats a sensitive screenshot or internal chart as artwork, that file can leave the machine and enter the connected Lark account.

This is a clear cloud-data disclosure risk: the skill requires extensive image use, and when creating or adding slides, an image referenced as `@<local path>` is automatically uploaded by the CLI and replaced with a cloud file token. Once generated XML references a local image, its contents leave the device; the shown instructions do not require per-file confirmation. A user can restrict readable/uploadable directories and require a list of every local file and destination account before upload.

SKILL.md:21In the instructions
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。
Show 2 other places
references/xml/xml-schema-quick-ref.md:234In the instructions
`src` 只支持：`slides +media-upload` 返回的 `file_token`，或 `@<本地路径>` 占位符（`+create --slides` 和 `+add-slide` 会自动上传并替换）。**禁止使用 http(s) 外链 URL**——飞书 slides 渲染端不会代理外链图，外链 src 在 PPT 里通常不显示。本地图片详见 [lark-slides-create.md](../cli/lark-slides-create.md#本地图片path-占位符) / [lark-slides-media-upload.md](../cli/lark-slides-media-upload.md)。
references/xml/xml-schema-quick-ref.md:238In the instructions
- 新建带图 PPT：`+create --slides` 里直接写 `src="@./pic.png"`，CLI 在创空白 PPT 后、加 slides 前自动上传并替换 token- 给已有 PPT 加带图新页：`+add-slide --slide` 的 XML 里直接写 `src="@./pic.png"`，CLI 上传后替换 token 再提交页面
Medium risk

Domain-blind routing may give a Doubao access token to the wrong service

Source references: 3
What we found

The Skill directs the agent to ignore the domain difference and use the Lark slides path for a doubao.com `/slides/` URL/token. The domain is normally part of a token's service and trust boundary, while the supplied material shows no compatibility check or identified token recipient.

Why this matters

If the services do not share tokens, the token could reach a CLI or backend that should not receive it, or the wrong account's presentation could be read or changed.

What this evidence establishes

The Skill does route doubao.com `/slides/` URLs/tokens to a slides workflow backed by `lark-cli` rather than using the domain as the routing boundary. However, the supplied lines do not show how the CLI validates, parses, or transmits the token, so they cannot establish whether it reaches the wrong service or a compatible shared backend. A user can ask the author to document the token recipient and compatibility mechanism, and restrict use to explicitly authorized presentations.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructions
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 2 other places
SKILL.md:7In the instructions
  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"
SKILL.md:6In the instructions
metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---
Medium risk

Mandatory image generation and search may disclose presentation subjects or sensitive details

Source references: 3
What we found

The Skill requires many unique images and specifies generation or search tools for the cover. Producing prompts or queries commonly requires extracting presentation topics and details, but the rule does not distinguish public from confidential material or require user consent.

Why this matters

Internal project names, strategy, customer data, or unreleased material could enter third-party image services; repeated generation may also consume paid quotas.

What this evidence establishes

These are active design requirements: the output must use many non-repeated images, the cover must use an image-generation or search tool, and generation prompts have a prescribed ending. The visible source does not establish that those tools are networked, that prompts go to a third party, or that presentation text or sensitive details must be included in queries. External disclosure is therefore conditional and unproven. A user can restrict the workflow to local assets or require approval of outbound prompts.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:21In the instructions
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。
Show 2 other places
SKILL.md:22In the instructions
- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。
SKILL.md:26In the instructions
- 禁止在任何页面内部使用无意义的装饰线条或色块条带，页面任何一边都不要使用贴边窄条。- 生图工具的指令参数必须以“不要出现任何文字和颜色色号”结尾，避免生成的图片上出现干扰文字。- 禁止使用 emoji 图标，任何位置都不能出现。
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 5
High risk

Whole-page updates can delete omitted content and overwrite later collaborative edits from an old snapshot

Source references: 4
What we found

`+update-slide` is not a patch: omitted elements are deleted and omitted notes are cleared. Its `revision-id` is not strict concurrency protection; an old revision rebuilds the page from an old snapshot.

Why this matters

Images, text, notes, or changes made by collaborators after the read may be permanently lost while the slide ID remains unchanged, making the loss less obvious.

This is active write behavior, not merely an example: `+update-slide` makes the supplied XML the page's final state, deleting omitted elements and clearing omitted notes. An old `revision_id` can rebuild from an old snapshot and overwrite later collaborator edits. It should be limited to explicitly authorized full-page replacement, with a fresh readback and preservation of everything not approved for removal.

references/cli/lark-slides-update-slide.md:35In the instructions
| `--content` | 是 | 这一页的完整目标 XML，单一 `<slide>` 根；支持字面量、`@file`、stdin `-`。别名：`--xml` / `--slide-xml` / `--slide-content` / `--content-xml` || `--revision-id` | 否 | 默认 `-1`（最新）。它只选择服务端执行所基于的快照，不是“页面有新编辑就拒绝”的乐观锁；传旧版本号会以旧快照重建页面并丢弃其后的编辑 || `--tid` | 否 | 调用方提供的任务/事务标识，CLI 原样透传；用于关联同一编辑任务或重试，不等同于版本前置条件，不能单独保证并发冲突时拒绝写入。一般留空 |`@file` 和 `+xml-get --output` 一样**只接受当前目录下的相对路径**，绝对路径会被拒。命令别名：`slides +update`（隐藏）；服务别名：`lark-cli slide …` 等价于 `lark-cli slides …`。如果要求“从读取之后页面一旦变化就不再写入”，不能只传 `--revision-id` 或 `--tid`。写入前必须再次用 `+xml-get` 回读最新版，比较读取期间是否发生变化；有变化时先基于最新版重新合并本次修改，再执行整页写回。当前 shortcut 不提供严格的 compare-and-swap 保证。
Show 3 other places
references/cli/lark-slides-update-slide.md:43In the instructions
## 语义：`--content` 就是这一页的最终状态**没写进 `--content` 的东西会从页面上消失。** 这不是补丁，是整页覆盖。| 你在 `--content` 里怎么写 | 页面上的结果 ||---|---|| 元素带原来的 `id` | 按新 XML 更新这个元素 || 元素不带 `id` | 作为新元素插入到它所在的位置 || 原来有、`--content` 里没有的元素 | **删除** || `<style>` 改了 | 背景等页面样式跟着改 || 没写 `<note>` | 讲者备注被清空 |
references/cli/lark-slides-update-slide.md:41In the instructions
如果要求“从读取之后页面一旦变化就不再写入”，不能只传 `--revision-id` 或 `--tid`。写入前必须再次用 `+xml-get` 回读最新版，比较读取期间是否发生变化；有变化时先基于最新版重新合并本次修改，再执行整页写回。当前 shortcut 不提供严格的 compare-and-swap 保证。
references/cli/lark-slides-update-slide.md:45In the instructions
**没写进 `--content` 的东西会从页面上消失。** 这不是补丁，是整页覆盖。| 你在 `--content` 里怎么写 | 页面上的结果 ||---|---|| 元素带原来的 `id` | 按新 XML 更新这个元素 || 元素不带 `id` | 作为新元素插入到它所在的位置 || 原来有、`--content` 里没有的元素 | **删除** || `<style>` 改了 | 背景等页面样式跟着改 || 没写 `<note>` | 讲者备注被清空 |
Medium risk

Page deletion and history rollback change the cloud document in place

Source references: 3
What we found

Page deletion is explicitly described as irreversible in place, while history rollback asynchronously changes the entire presentation. Both can affect a shared file being used by collaborators.

Why this matters

Selecting the wrong slide ID or history version can remove the correct page or restore the entire presentation to the wrong state, potentially discarding other people's newer edits.

Deletion and rollback are real cloud mutations. Deletion removes a page by `slide_id`; history rollback asynchronously changes the presentation, and a status-query failure must not trigger a second rollback. The documentation includes readback, screenshot, and candidate-confirmation safeguards, but collaborators can still be affected. Users can require explicit confirmation of the deck, page, or history entry and prohibit duplicate rollback requests.

references/cli/lark-slides-delete-slide.md:48In the instructions
`slide_id` 是服务端短 ID，**不能从 XML 里推导**。两个来源：1. `+create` / `+add-slide` 的返回值里存下来；2. 事后回读：`slides +xml-get --presentation "$PRES_ID" --output .lark-slides/plan/<deck>/readback.xml`。删错页的代价高于多跑一次回读 —— 不确定就先回读 + `+screenshot` 看一眼再删。## 删错了怎么办删除在原地不可撤销，但可以走历史版本回滚：`+history-list` 找 `history_version_id` → `+history-revert`（只接受 `history_version_id`，不能传 `revision_id`）→ `+history-revert-status` 轮询。命令用法见 [lark-slides-history.md](lark-slides-history.md)。
Show 2 other places
references/cli/lark-slides-history.md:12In the instructions
3. 如果用户指定的是某一时刻但没有指定 `revision_id`，按 `entries[].edit_time` 匹配；优先选择不晚于目标时刻的最近一条历史记录，无法明确匹配时先向用户确认候选版本。4. 使用 `+history-revert` 发起回滚。接口会立即返回 `task_id`，回滚任务在服务端异步执行。5. 如果返回 `status: running`，保存 `task_id`，按照返回的 `poll_after_ms` 等待后调用 `+history-revert-status`。任务创建成功后，不得因为状态查询失败而重新发起回滚。6. 状态变为 `done`、`partial_failed` 或 `failed` 后停止轮询；达到整体轮询上限时也停止轮询，并向用户返回 `task_id` 和当前状态。7. 回滚完成后，用 `slides +xml-get` 或 `slides xml_presentations get` 读取演示文稿确认内容。
references/cli/lark-slides-history.md:9In the instructions
1. 先用分页接口 `+history-list` 找到目标版本的 `history_version_id`。2. 如果用户指定的是 `revision_id`，不要假设它唯一，也不要把 `revision_id` 直接传给 `+history-revert`。先拉一页并在 `entries[]` 中筛选 `revision_id` 相同的候选；如果未匹配到且 `has_more=true`，继续用 `page_token` 翻页；如果已匹配到候选，最多额外再拉一页补齐可能跨页的相邻候选。最终优先根据用户目标时间与 `edit_time` 的接近程度选择最合适的一条，取同一条的 `history_version_id`；如果没有目标时间，或多个候选无法可靠区分，再向用户展示候选版本（`history_version_id`、`revision_id`、`edit_time`、`name/description`）并确认后回滚。3. 如果用户指定的是某一时刻但没有指定 `revision_id`，按 `entries[].edit_time` 匹配；优先选择不晚于目标时刻的最近一条历史记录，无法明确匹配时先向用户确认候选版本。4. 使用 `+history-revert` 发起回滚。接口会立即返回 `task_id`，回滚任务在服务端异步执行。5. 如果返回 `status: running`，保存 `task_id`，按照返回的 `poll_after_ms` 等待后调用 `+history-revert-status`。任务创建成功后，不得因为状态查询失败而重新发起回滚。6. 状态变为 `done`、`partial_failed` 或 `failed` 后停止轮询；达到整体轮询上限时也停止轮询，并向用户返回 `task_id` 和当前状态。7. 回滚完成后，用 `slides +xml-get` 或 `slides xml_presentations get` 读取演示文稿确认内容。
Medium risk

Whole-slide write-back can silently recreate elements and break comments and old links

Source references: 3
What we found

Whole-slide updates use IDs from the read-back XML to identify retained elements. If those IDs were removed, write-back treats every element as new, deletes the originals, and creates replacements; the documentation says the slide may look unchanged and no error is raised.

Why this matters

Comments anchored to old elements and direct block links become invalid, potentially damaging collaboration references. Visual read-back or screenshots may not reveal this loss.

The documentation explicitly says full-page writeback relies on IDs from the readback XML. If `--remove-attr-id` is used before writeback, every element is treated as new, old elements are deleted, and comments or direct block links can silently break. This is conditional, not an inevitable result of every update. Users can require preservation of existing IDs, a dry run, and post-write ID verification.

references/cli/lark-slides-update-slide.md:75In the instructions
```bash# 1. 读回当前页（拿到带 id 的完整 XML）lark-cli slides +xml-get --as user \  --presentation "$PRES" --slide-id "$SLIDE" --output page.xml# 2. 编辑 page.xml —— 保留想留下的元素的 id，删掉不要的整段，新元素不写 id# 3. 整页写回lark-cli slides +update-slide --as user \  --presentation "$PRES" --slide-id "$SLIDE" --content @page.xml```先 `--dry-run` 看请求，确认无误再执行。> ⚠️ **第 1 步不要加 `--remove-attr-id`。** 那个参数会把所有元素的 `id` 去掉，再交给 `+update-slide` 的话，每个元素都会被当成新元素插入、原来的全部被删除——页面看起来一样，但所有元素换了新 id，锚在旧 id 上的评论和 block 直达链接全部失效，而且**不会有任何报错**。`--remove-attr-id` 只用于只读查看。
Show 2 other places
references/cli/lark-slides-update-slide.md:87In the instructions
先 `--dry-run` 看请求，确认无误再执行。> ⚠️ **第 1 步不要加 `--remove-attr-id`。** 那个参数会把所有元素的 `id` 去掉，再交给 `+update-slide` 的话，每个元素都会被当成新元素插入、原来的全部被删除——页面看起来一样，但所有元素换了新 id，锚在旧 id 上的评论和 block 直达链接全部失效，而且**不会有任何报错**。`--remove-attr-id` 只用于只读查看。
references/cli/lark-slides-update-slide.md:121In the instructions
写入成功后，必须回读整份演示文稿的最新 XML，而不是只相信写接口的成功响应：```bashlark-cli slides +xml-get --as user \  --presentation "$PRES" --output readback.xml```按当前已加载 `lark-slides/SKILL.md` 指向的 [validation-xml.md](../workflow/validation-xml.md) 完成验证：核对总页数、目标页和关键元素（包括需要保留的 ID、文本、背景与备注），并对回读 XML 运行同一版式 lint；发现差异时先停止后续写入并重新基于最新版处理。
Medium risk

Changing one property requires replacing the entire slide block

Source references: 4
What we found

The API does not support field-level patches; even a coordinate adjustment requires new XML for the complete block. If reconstruction is incomplete but accepted, omitted text, styling, links, or notes may be lost.

Why this matters

The online presentation can receive persistent changes beyond what the user requested. Atomic rollback covers failed requests, not a syntactically valid but incomplete replacement.

The documentation explicitly says that even a coordinate-only change requires replacing the entire block with new XML; individual fields cannot be patched. Therefore, if reconstruction omits existing text, styling, or links, those contents may disappear with the block replacement. Transaction atomicity only prevents partial batch success and does not ensure the replacement XML is complete. A user can require a full-block before/after diff and a recoverable version before submission.

references/cli/lark-slides-xml-presentation-slide-replace.md:178In the instructions
3. **`<img>` 必须用 file_token**：不能用外链 URL——先 [`slides +media-upload`](lark-slides-media-upload.md) 拿 token。4. **不能字段级 patch**：要改一个块的某个属性（比如只改 `topLeftX`），得写整块新 XML 走 `block_replace`；API 不支持"只改一个字段"。5. **`block_replace` 要求 `replacement` 根元素带 `id="<block_id>"`**：底层 API 的硬约束，缺失会返回 3350001。推荐走 shortcut [`+replace-slide`](lark-slides-replace-slide.md)——它会自动把 `id` 注入到 `replacement` 根元素上，用户写 XML 时不用自己加。6. **`<shape>` 必须有 `<content/>` 子元素**：SML 2.0 schema 要求，缺失同样触发 3350001。shortcut [`+replace-slide`](lark-slides-replace-slide.md) 会自动注入 `<content/>`，直接调底层 API 需要自己加。7. **执行前必做**：`lark-cli schema slides.xml_presentation.slide.replace` 查看最新参数结构。
Show 3 other places
references/cli/lark-slides-xml-presentation-slide-replace.md:175In the instructions
1. **parts 原子事务**：任一条失败整批回滚，不会出现"前几条成功、后几条失败"的中间态。2. **block_id 的获取**：`slide.get` 返回的 XML 里每个块（shape、img、table、chart 等）会带 3 位 short element ID，用这个值填 `block_id` / `insert_before_block_id`。
references/cli/lark-slides-xml-presentation-slide-replace.md:171In the instructions
| 400 | XML 格式错误 | `replacement` / `insertion` 必须为合法的 XML 片段，标签闭合 + 属性引号 || 403 | 权限不足 | 需要 `slides:presentation:update` 或 `slides:presentation:write_only` |
references/cli/lark-slides-xml-presentation-slide-replace.md:179In the instructions
4. **不能字段级 patch**：要改一个块的某个属性（比如只改 `topLeftX`），得写整块新 XML 走 `block_replace`；API 不支持"只改一个字段"。5. **`block_replace` 要求 `replacement` 根元素带 `id="<block_id>"`**：底层 API 的硬约束，缺失会返回 3350001。推荐走 shortcut [`+replace-slide`](lark-slides-replace-slide.md)——它会自动把 `id` 注入到 `replacement` 根元素上，用户写 XML 时不用自己加。6. **`<shape>` 必须有 `<content/>` 子元素**：SML 2.0 schema 要求，缺失同样触发 3350001。shortcut [`+replace-slide`](lark-slides-replace-slide.md) 会自动注入 `<content/>`，直接调底层 API 需要自己加。
Low risk

Multi-page creation is non-atomic and can leave an incomplete cloud presentation after failure

Source references: 3
What we found

The workflow creates an empty presentation first and then adds pages sequentially; a mid-process failure does not remove the presentation or pages already created.

Why this matters

Blank or partly completed presentations may remain in the user's account, causing confusion, accidental sharing, or later work against the wrong version.

The documentation explicitly says creation with pages first creates an empty cloud presentation and then adds pages one by one. It is not atomic, and a page failure leaves the presentation and previously added pages in place. This can expose an incomplete deck or create confusing duplicates. Users can require the new presentation ID to be recorded, immediate readback after failure, and no deletion or replacement creation without confirmation.

references/cli/lark-slides-create.md:18In the instructions
> [!IMPORTANT]> `slides +create` 带页面时底层会逐页创建，不是原子操作。中途失败时先记录 `xml_presentation_id`，回读确认当前状态，再继续修复或追加。**CRITICAL — 提交前必须先跑版式 lint**：把待提交的 `<slide>` XML 存成本地文件，运行 [`scripts/xml_lint.py`](../../scripts/xml_lint.py)，`summary.error_count` 必须为 0。
Show 2 other places
references/cli/lark-slides-create.md:58In the instructions
> [!IMPORTANT]> 不带页面参数时，`slides +create` 只创建空白演示文稿。创建后用 [`+add-slide`](lark-slides-add-slide.md) 逐页添加 slide 内容。>> 带了页面时，CLI 先创建空白演示文稿，再逐页调用 slide 创建接口添加页面。如果某一页添加失败，CLI 会停止并报错，已创建的演示文稿和已添加的页面会保留。>
references/workflow/error-handling.md:16In the instructions
遇到 `invalid param`、某一页创建失败、页面空白或布局错乱时，按顺序处理：1. 记录 `xml_presentation_id`，不要假设失败代表什么都没创建。2. 用 `slides +xml-get` 回读，确认是否已有部分页面写入。3. 检查失败页是否含未转义字符：`Q&A -> Q&amp;A`，文本 `<` / `>` 写成 `&lt;` / `&gt;`，属性 URL `a=1&b=2 -> a=1&amp;b=2`。
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 6
Medium risk

Path-only URL routing can treat a third-party link as a Lark resource identifier without validating its domain

Source references: 4
What we found

The Skill explicitly routes `/slides/` URLs from any domain, including doubao.com, directly to this Skill and treats the path token as a presentation ID. Subsequent operations default to the user's identity.

Why this matters

A misleading link could trigger Lark API requests with the user's authority. If the token identifies a resource the user can access, the Skill could read or modify a presentation the user did not intend to target.

The routing instruction explicitly treats `/slides/` links on a non-Lark domain such as doubao.com as Slides tokens and defaults subsequent operations to the current user's identity. A deceptive link containing another valid token could therefore target an unintended deck. The evidence does not prove the CLI accepts every domain, but the Skill's decision rule is risky; users can require trusted Lark domains or confirmation of the resolved deck before writes.

SKILL.md:4In the instructions
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 3 other places
SKILL.md:122In the instructions
飞书幻灯片通常是用户自己的内容资源。**默认应优先显式使用 `--as user`（用户身份）执行 slides 相关操作**，始终显式指定身份。- **`--as user`（推荐）**：以当前登录用户身份创建、读取、管理演示文稿。执行前先完成用户授权：
SKILL.md:250In the instructions
|----------|------|-----------|----------|| `/slides/` | `https://example.larkoffice.com/slides/xxxxxxxxxxxxx` | `xml_presentation_id` | URL 路径中的 token 直接作为 `xml_presentation_id` 使用 || `/wiki/` | `https://xxx.feishu.cn/wiki/wikcn_EXAMPLE_NODE_TOKEN_123456` | `wiki_token` | ⚠️ **不能直接使用**，需要先查询获取真实的 `obj_token` |
SKILL.md:248In the instructions
| URL 格式 | 示例 | Token 类型 | 处理方式 ||----------|------|-----------|----------|| `/slides/` | `https://example.larkoffice.com/slides/xxxxxxxxxxxxx` | `xml_presentation_id` | URL 路径中的 token 直接作为 `xml_presentation_id` 使用 || `/wiki/` | `https://xxx.feishu.cn/wiki/wikcn_EXAMPLE_NODE_TOKEN_123456` | `wiki_token` | ⚠️ **不能直接使用**，需要先查询获取真实的 `obj_token` |
Medium risk

Bot-based creation attempts to grant the current CLI user full management access

Source references: 4
What we found

When a presentation is created under the application identity, the CLI attempts to grant `full_access` to the current CLI user. This is an additional permission change, not merely file creation.

Why this matters

If the CLI is logged into the wrong account, a shared terminal account, or a member whose access should not expand, that account may gain the ability to manage, alter, or further share the presentation.

When creation uses `--as bot`, the CLI attempts an additional permission change: granting `full_access` to the current CLI user. The main Skill limits bot identity to explicit requests or bot-owned-resource workflows, and the result reports the grant status. A user can require `--as user`, or confirm exactly who the current CLI user is and whether that account should receive management access before bot creation.

references/cli/lark-slides-create.md:38In the instructions
# 以应用身份创建（自动授权当前用户）lark-cli slides +create --title "项目汇报" --as bot
Show 3 other places
references/cli/lark-slides-create.md:61In the instructions
>> 带了页面时，CLI 先创建空白演示文稿，再逐页调用 slide 创建接口添加页面。如果某一页添加失败，CLI 会停止并报错，已创建的演示文稿和已添加的页面会保留。>> 如果演示文稿是**以应用身份（bot）创建**的，如 `lark-cli slides +create --as bot`，CLI 会**尝试为当前 CLI 用户自动授予该演示文稿的 `full_access`（可管理权限）**。>> 以应用身份创建时，结果里会额外返回 `permission_grant` 字段，明确说明授权结果：> - `status = granted`：当前 CLI 用户已获得该演示文稿的可管理权限> - `status = skipped`：本地没有可用的当前用户 `open_id`，因此不会自动授权> - `status = failed`：演示文稿已创建成功，但自动授权用户失败>
SKILL.md:130In the instructions
- **`--as bot`**：仅在用户明确要求以应用身份操作，或需要让 bot 持有/创建资源时使用。使用 bot 身份时，要额外确认 bot 是否真的有目标演示文稿的访问权限。**执行规则**：1. 创建、读取、增删 slide、按用户给出的链接继续编辑已有 PPT，默认都先用 `--as user`。2. 如果出现权限不足，先检查当前是否误用了 bot 身份；不要默认回退到 bot。3. 只有在用户明确要求"用应用身份 / bot 身份操作"，或当前工作流就是 bot 创建资源后再做协作授权时，才切换到 `--as bot`。
references/cli/lark-slides-create.md:63In the instructions
>> 如果演示文稿是**以应用身份（bot）创建**的，如 `lark-cli slides +create --as bot`，CLI 会**尝试为当前 CLI 用户自动授予该演示文稿的 `full_access`（可管理权限）**。>> 以应用身份创建时，结果里会额外返回 `permission_grant` 字段，明确说明授权结果：> - `status = granted`：当前 CLI 用户已获得该演示文稿的可管理权限> - `status = skipped`：本地没有可用的当前用户 `open_id`，因此不会自动授权> - `status = failed`：演示文稿已创建成功，但自动授权用户失败>
Medium risk

Routing deliberately ignores the domain and may pass Doubao links or tokens into the Lark workflow

Source references: 2
What we found

The Skill directs the agent to activate for a doubao.com `/slides/` URL or token and explicitly says routing is not based on the domain. The domain normally helps establish which account system and resource owns an identifier.

Why this matters

If a similar-looking path or token belongs to another service, tenant, or identity, subsequent reads or writes could target the wrong resource or expose that token to a CLI that should not process it.

What this evidence establishes

The evidence confirms that doubao.com `/slides/` links are routed by path/token rather than falling back to web fetching. It does not show which backend receives the token, whether Doubao and Lark tokens are intentionally compatible, or whether any cross-account access occurs. The claimed account/resource confusion is therefore uncertain. Users can ask for the token-resolution target, backend boundary, and resolved presentation identity before any read or write.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructions
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 1 other places
SKILL.md:2In the instructions
---name: lark-slidesversion: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---
Medium risk

Hyperlink validation is broader than the documented HTTP/HTTPS-only boundary

Source references: 3
What we found

The hyperlink documentation says only HTTP/HTTPS is supported, but the XSD also accepts FTP, SFTP, FTPS, NFS, SSH, email addresses, and a broad name-plus-colon form. This mismatch weakens protocol controls on generated links.

Why this matters

Malicious or mistaken content can create non-Web links in a presentation. Clicking them may launch email, SSH, file-sharing, or another local protocol handler, connect to internal resources, or send information externally.

The documentation says `href` supports only HTTP/HTTPS, but the XSD patterns also accept FTP, SFTP, FTPS, NFS, SSH, email addresses, and a broad “name plus colon” form. Schema validation alone therefore cannot enforce the stated protocol restriction; clicking a generated link could invoke a non-web protocol or external client. A user can require an additional HTTP/HTTPS allowlist at submission or rendering time and a reviewable list of all links before delivery.

references/xml/slides_xml_schema_definition.xml:2072In the instructions
            <xs:documentation>                超链接元素                属性: href (仅支持 http/https)            </xs:documentation>        </xs:annotation>
Show 2 other places
references/xml/slides_xml_schema_definition.xml:2090In the instructions
            </xs:choice>            <xs:attribute name="href" use="required">                <xs:simpleType>                    <xs:restriction base="xs:anyURI">                        <xs:pattern value="(https?|s?ftp|ftps|nfs|ssh)://\S+"/>                        <xs:pattern value="[\w.-]+[.:]\S*"/>                        <xs:pattern value="(mailto:)?\S+@\S+\.\w{2,}"/>                    </xs:restriction>                </xs:simpleType>
references/xml/slides_xml_schema_definition.xml:2092In the instructions
                <xs:simpleType>                    <xs:restriction base="xs:anyURI">                        <xs:pattern value="(https?|s?ftp|ftps|nfs|ssh)://\S+"/>                        <xs:pattern value="[\w.-]+[.:]\S*"/>                        <xs:pattern value="(mailto:)?\S+@\S+\.\w{2,}"/>                    </xs:restriction>
Medium risk

Path-and-token-only cross-domain routing may send the wrong or untrusted link to an account-level slide tool

Source references: 3
What we found

The Skill explicitly directs the agent to handle a `doubao.com` `/slides/` URL/token through this Skill even though the domain is not Feishu, stating that routing should rely on the path and token. A domain is normally an important service and trust-boundary signal; path matching alone can confuse identifiers or permission scopes between services.

Why this matters

If a user pastes a forged, misdirected, or different-service link, the agent could attempt to read or modify the wrong presentation through an authenticated `lark-cli`, or expose the token in commands or logs. The visible excerpt does not establish that this has occurred.

What this evidence establishes

This is an active routing instruction: it sends doubao.com `/slides/` URLs/tokens to the slides skill backed by `lark-cli`, and says routing is not based on the domain. However, it names one specific domain rather than accepting arbitrary domains, and the supplied evidence does not show how tokens are validated, which service receives them, or what account permissions are used. A misrouting risk is therefore plausible but not established. A user can ask the author to document the trust relationship with doubao.com and the server-side token validation scope.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructions
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 2 other places
SKILL.md:6In the instructions
metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---
SKILL.md:7In the instructions
  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"
Medium risk

Cross-domain routing by `/slides/` path and token can confuse service and credential boundaries

Source references: 2
What we found

The Skill explicitly sends a `doubao.com` slide URL/token into the Lark Slides workflow and says routing should not depend on the domain. The domain is normally an important boundary for deciding which service issued a token; the shown material does not establish how `lark-cli` validates the issuer or target resource.

Why this matters

If the services use incompatible or forwardable tokens, or if a URL is disguised, the token could reach an unintended client or backend, or the wrong presentation/account could be accessed. The evidence does not show that such disclosure or misuse has occurred.

What this evidence establishes

The instruction does route doubao.com `/slides/` URLs/tokens to lark-slides despite the different domain. If that token is forwarded to a backend outside its issuing service, it could expose a resource identifier or target the wrong resource. However, the provided line only defines skill routing; it does not show where the token is sent, whether it is a credential, or how `lark-cli` validates the service and resource. The user can ask for the token type, recipient, and issuer/domain validation, and restrict cross-domain token forwarding.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:4In the instructions
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
Show 1 other places
SKILL.md:7In the instructions
  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

A missing real logo may be replaced with a misleading “close-enough” generated logo

Source references: 4
What we found

The planning example explicitly directs the image tool to create a “close-enough image” when a real logo is missing, while defining the logo's purpose as signaling product, team, or customer identity. It does not require labeling the generated result as unofficial.

Why this matters

A deck could display an invented or distorted mark as a real brand asset, misleading customers, executives, or the public and creating brand-guideline, trademark, or reputational risk.

This is a decision-integrity risk rather than a credential or file risk. The active planning rules allow a “close-enough” generated image when a logo is missing, while examples use logos to signal product, team, or customer identity. The supplied rules do not require a conspicuous non-official label, so an audience could misread the generated mark as authentic. Users can prohibit approximate brand marks and require a clearly labeled placeholder when the real logo is unavailable.

references/planning-layer.md:87In the instructions
      "visual_focus": "Large title area with one concise supporting statement.",      "asset_need": {        "asset_type": "logo",        "purpose": "Signal product or team identity on the opening page.",        "suggested_query": "product logo",        "fallback_if_missing": "Create a close-enough image with the image generation tool instead of a real logo."      },      "text_density": "low",      "speaker_intent": "Frame the decision and establish the deck's point of view."    }
Show 3 other places
references/planning-layer.md:219In the instructions
Good examples:- `{"asset_type":"architecture_diagram","purpose":"Explain component relationships.","suggested_query":"service architecture diagram","fallback_if_missing":"Render the component diagram with <shape> + <line>."}`- `{"asset_type":"logo","purpose":"Identify the customer context.","suggested_query":"customer logo","fallback_if_missing":"Create a close-enough image with the image generation tool instead of a real logo."}`- `{"asset_type":"chart","purpose":"Show adoption trend.","suggested_query":"monthly adoption trend chart","fallback_if_missing":"Render a native `<chart>` using the provided series when available; otherwise render a native `<chart>` with mock placeholder values and label it as 模拟数据，仅占位，待替换真实数据."}`
references/planning-layer.md:207In the instructions
`asset_need` is metadata. It can describe a desired figure, diagram, chart, icon, logo, screenshot, or fallback visual.Use an object for one planned asset, an array for multiple real needs, or `asset_type: "none"` when no asset is useful. Each planned asset must include:- `asset_type`: one of `paper_figure`, `architecture_diagram`, `icon`, `logo`, `chart`, `infographic`, `screenshot`, `flow_diagram`, or `none`.- `purpose`: why this asset helps the page's key message.- `suggested_query`: short future lookup hint only; do not execute it unless separately requested.- `fallback_if_missing`: a plan to create a close-enough image with the image generation tool, or a native `<chart>` for data.- `chart_contract`: when `asset_type` is `chart` and the visual is a supported standard data chart, set this optional slide-level field so generation is locked to native `<chart>`.
references/planning-layer.md:221In the instructions
- `{"asset_type":"architecture_diagram","purpose":"Explain component relationships.","suggested_query":"service architecture diagram","fallback_if_missing":"Render the component diagram with <shape> + <line>."}`- `{"asset_type":"logo","purpose":"Identify the customer context.","suggested_query":"customer logo","fallback_if_missing":"Create a close-enough image with the image generation tool instead of a real logo."}`- `{"asset_type":"chart","purpose":"Show adoption trend.","suggested_query":"monthly adoption trend chart","fallback_if_missing":"Render a native `<chart>` using the provided series when available; otherwise render a native `<chart>` with mock placeholder values and label it as 模拟数据，仅占位，待替换真实数据."}`
Medium risk

Mandatory high-volume image generation or search may cause unexpected usage charges

Source references: 2
What we found

Regardless of the user's request, the Skill prohibits image-free delivery, requires many non-reused images, and directs the agent to use image generation for concrete objects.

Why this matters

When connected image-generation, search, or asset services charge per call or by usage, one presentation may trigger many calls, increasing cost and completion time. The shown instructions set no image-count or spending limit.

These are active global requirements, not examples or warnings: the skill forbids image-free output, demands many non-reused images, and directs cover and concrete-object visuals to image-generation or image-search tools. If those tools charge per request or usage, this can increase calls and costs beyond a basic slide request and may involve additional network processing. The user can cap image counts, disallow paid generation/search, and require confirmation before external calls. The evidence supports a conditional cost risk, not that the tools are paid or were used.

SKILL.md:21In the instructions
- PPT 的尺寸是 960x540，必须严格确保主体内容在页面边界内。- !!!禁止交付无图产物!!! 必须使用大量图片增强视觉效果!!! 禁止重复使用同一张图!!!- 封面页的主视觉必须是 `<img>`（来自生图工具或搜图工具），不要使用 `<shape>` 或 `<icon>` 拼出封面视觉。- 禁止用 `<shape>` 和 `<line>` 拟形具体物项，必须使用生图工具生成的 `<img>`。- 禁止在 `headline` 或 `title` 下方放置用于分隔或装饰的 `rect` 或 `<line>`。
Show 1 other places
SKILL.md:26In the instructions
- 禁止在任何页面内部使用无意义的装饰线条或色块条带，页面任何一边都不要使用贴边窄条。- 生图工具的指令参数必须以“不要出现任何文字和颜色色号”结尾，避免生成的图片上出现干扰文字。- 禁止使用 emoji 图标，任何位置都不能出现。

Inside this skill

8 instruction sections

This Skill defaults to the currently logged-in user identity and can create, read, add, delete, and edit presentations; first use requires Slides-domain login authorization.

View source
SKILL.md:122In the instructions
飞书幻灯片通常是用户自己的内容资源。**默认应优先显式使用 `--as user`（用户身份）执行 slides 相关操作**，始终显式指定身份。- **`--as user`（推荐）**：以当前登录用户身份创建、读取、管理演示文稿。执行前先完成用户授权：```bashlark-cli auth login --domain slides```
SKILL.md:134In the instructions
1. 创建、读取、增删 slide、按用户给出的链接继续编辑已有 PPT，默认都先用 `--as user`。2. 如果出现权限不足，先检查当前是否误用了 bot 身份；不要默认回退到 bot。3. 只有在用户明确要求"用应用身份 / bot 身份操作"，或当前工作流就是 bot 创建资源后再做协作授权时，才切换到 `--as bot`。

For new or substantially rewritten decks, it stores plans, generated XML, read-back XML, and screenshots in the working directory; the plan may remain after successful completion.

View source
references/planning-layer.md:36In the instructions
`.lark-slides/` is local agent state. It supports recovery, iteration, and later edits, but it should not be treated as source code or committed by default.Keep:- `.lark-slides/plan/<deck-or-task-id>/slide_plan.json` after successful creation or major rewrite. The plan is the editable design state for the deck.- A small manifest when useful for follow-up work, such as `xml_presentation_id`, slide IDs, `revision_id`, plan path, and verification status.
references/cli/lark-slides-screenshot.md:5In the instructions
获取幻灯片页面截图并保存为本地图片文件。默认用于已存在 PPT 页面截图；传入 `--content` 时用于直接渲染单个 `<slide>` XML 片段预览。本 shortcut 会在 CLI 进程内解码并写入文件，stdout 只返回文件路径、大小、页面 ID 等元信息，避免把图片 Base64 输出给模型。

The included icon-search script reads an offline JSON index within the Skill and prints search results; the shown implementation contains no network calls or command-execution logic.

View source
scripts/iconpark_tool.py:14In the code
SKILL_ROOT = Path(__file__).resolve().parent.parentREFERENCES_DIR = SKILL_ROOT / "references"DEFAULT_INDEX_PATH = REFERENCES_DIR / "xml" / "iconpark-index.json"DEFAULT_LIMIT = 8CURATED_ICON_BOOSTS = {
scripts/iconpark_tool.py:147In the code
def load_index(path: str | Path = DEFAULT_INDEX_PATH) -> dict[str, Any]:    index_path = Path(path)    if not index_path.exists():        fail(f"iconpark index not found: {index_path}")    try:        index_data = json.loads(index_path.read_text(encoding="utf-8"))    except json.JSONDecodeError as error:        fail(f"invalid iconpark index JSON: {error}")    if not isinstance(index_data.get("icons"), list):        fail("iconpark index must contain an icons array")    return index_data

The Skill requires read-back and local XML linting after writes; errors block delivery and warnings require screenshot review. This reduces accidental-write risk but does not replace confirmation of the target document and authorization scope.

View source
references/workflow/validation-xml.md:9In the instructions
1. 记录创建或编辑返回的 `xml_presentation_id`，以及已知的 `slide_id` / `revision_id`。2. 用 `slides +xml-get` 回读全文 XML 到本地文件。3. 检查实际页数是否符合计划或用户要求。4. 检查每页 `<data>` 内是否有预期主要元素。5. 检查没有明显空白页、破损页、缺失标题或缺失主视觉。6. 检查页面不是全部退化为标题加 bullet list。7. 检查视觉层级：标题、主视觉、支撑信息三者可区分。8. 检查明显溢出和布局风险：重叠、越界、底部拥挤、长文本框。9. 在最终回复中给出简短验证记录。
references/workflow/validation-xml.md:40In the instructions
- `summary.error_count > 0` 或 `summary.release_ready == false`：阻断创建、替换或交付，必须先修复。- `summary.warning_count > 0`：静态检查不直接阻断，但 `summary.screenshot_review_required == true`，必须复核对应页面截图。- `slides[].status` 为 `blocked`、`needs_screenshot_review` 或 `passed`，可直接决定逐页后续动作。- CLI 在存在 `error` 时退出码为 1；只有 `warning` 时仍输出 JSON 并退出 0，供截图复核链路继续执行。

The Skill uses `lark-cli` to create, read, and edit Lark presentations. Creation accepts up to 10 slides per invocation; larger decks are created empty and populated slide by slide.

View source
SKILL.md:6In the instructions
metadata:  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"---
references/cli/lark-slides-create.md:77In the instructions
| `--title` | 否 | 演示文稿标题（不传则默认 "Untitled"） || `--slide` | 否 | 一页 `<slide>` XML，或 `@路径`；可重复，最多 10 次。格式见[页面输入形式](#页面输入形式) || `--slides` | 否 | 页面 XML 的 JSON 字符串数组，最多 10 个；支持 `@文件` 和 `-`（stdin）。格式见[页面输入形式](#页面输入形式) |10 页是 CLI 的上限，服务端每次只接收一页。超过 10 页时先用 `+create` 创建空白 PPT，再用 [`+add-slide`](lark-slides-add-slide.md) 逐页添加。两种形式的每一页都会在发请求前校验成「单个完整的 `<slide>` 文档」。不合格的页在创建演示文稿之前报错并指出页序号，不会留下空壳演示文稿。

Editing supports block replacement/insertion and whole-slide write-back. Batched block operations are described as atomic, while whole-slide updates depend on preserving element IDs to retain comments and direct links.

View source
references/workflow/slides-editing.md:101In the instructions
### 批量 parts一次 `--parts` 最多 200 条，按数组顺序串行执行。`block_replace` 和 `block_insert` 可以在同一批次混用。举例：一次性把标题块替换、然后在末尾追加一个装饰图。```bashlark-cli slides +replace-slide --as user \  --presentation "$PRES_ID" --slide-id "$SID" \  --parts '[{"action":"block_replace","block_id":"bab","replacement":"<shape type=\"text\" topLeftX=\"80\" topLeftY=\"80\" width=\"800\" height=\"120\"><content textType=\"title\"><p>新标题</p></content></shape>"},{"action":"block_insert","insertion":"<img src=\"<file_token>\" topLeftX=\"700\" topLeftY=\"400\" width=\"180\" height=\"100\"/>"}]'```整批作为原子事务：任一条失败整批不生效。失败时后端通常返回 3350001；若响应中带 `failed_part_index` / `failed_reason` 字段，shortcut 会原样透传。
references/cli/lark-slides-update-slide.md:80In the instructions
# 2. 编辑 page.xml —— 保留想留下的元素的 id，删掉不要的整段，新元素不写 id# 3. 整页写回lark-cli slides +update-slide --as user \  --presentation "$PRES" --slide-id "$SLIDE" --content @page.xml```先 `--dry-run` 看请求，确认无误再执行。> ⚠️ **第 1 步不要加 `--remove-attr-id`。** 那个参数会把所有元素的 `id` 去掉，再交给 `+update-slide` 的话，每个元素都会被当成新元素插入、原来的全部被删除——页面看起来一样，但所有元素换了新 id，锚在旧 id 上的评论和 block 直达链接全部失效，而且**不会有任何报错**。`--remove-attr-id` 只用于只读查看。

The Skill includes local static XML linting and requires fetching the latest presentation after writing; warnings also trigger review of server-rendered screenshots. Static linting is not treated as proof of final visual correctness.

View source
references/cli/lark-slides-update-slide.md:113In the instructions
和其他整页写入一样，把 `--content` 存成本地文件后先跑版式 lint。先取得当前已加载 `lark-slides/SKILL.md` 的父目录，记为 `<lark-slides-skill-dir>`；不要猜测全局安装路径：```bashpython3 "<lark-slides-skill-dir>/scripts/xml_lint.py" --input page.xml````summary.error_count` 必须为 0 才调接口；`warning_count > 0` 时写完要截图复核。写入成功后，必须回读整份演示文稿的最新 XML，而不是只相信写接口的成功响应：```bashlark-cli slides +xml-get --as user \  --presentation "$PRES" --output readback.xml```按当前已加载 `lark-slides/SKILL.md` 指向的 [validation-xml.md](../workflow/validation-xml.md) 完成验证：核对总页数、目标页和关键元素（包括需要保留的 ID、文本、背景与备注），并对回读 XML 运行同一版式 lint；发现差异时先停止后续写入并重新基于最新版处理。
references/workflow/validation-xml.md:146In the instructions
最终回复必须包含简短验证记录，建议格式：```text验证记录：- 回读：已执行 slides +xml-get，实际页数 N / 预期 N。- 关键页：架构解释 / Self-Attention / 对比或演进 / 总结页均存在。- 结构：检查了主要 shape/img/table/chart 元素，无明显空白页或破损页。- 布局：检查了标题层级、主视觉、重叠/越界/文本溢出风险。```不要声称完成了人工视觉验收，除非确实打开或获取了可视化结果。仅从 XML 静态检查得出的结论，应表述为“静态检查未发现明显问题”。

Planning rules allow mock chart data when real values are unavailable, but explicitly require labeling it as placeholder data, reducing the risk that invented values are presented as facts.

View source
references/asset-planning.md:71In the instructions
- Do not imitate supported standard data visuals with manual drawing primitives.- Choose the data source explicitly:  - `user_provided`: when the user provides concrete values, tables, CSV, or metric lists, use those values and do not replace them with mock data.  - `mock_placeholder`: when the user asks for a placeholder, template, example, or chart position to replace later, use mock data in a native `<chart>`.  - `mock_required_by_intent`: when the user does not provide concrete values but asks for data expression, charts, trends, comparisons, or distributions, use mock data in a native `<chart>`.- Mock data must be labeled as `模拟数据，仅占位，待替换真实数据` or equivalent. Do not present mock values as facts.- Manual drawing fallbacks are allowed only for unsupported chart types such as scatter, funnel, waterfall-like custom visuals, or decorative non-data visuals.

The Skill is presented as creating, reading, editing, and deleting slides and requires lark-cli, so actual use may read or change the user's online presentations.

View source
SKILL.md:4In the instructions
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
SKILL.md:7In the instructions
  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"

Modification requires Lark Slides write permission, and replacement batches are atomic: one failure rolls back the entire batch.

View source
references/cli/lark-slides-xml-presentation-slide-replace.md:171In the instructions
| 400 | XML 格式错误 | `replacement` / `insertion` 必须为合法的 XML 片段，标签闭合 + 属性引号 || 403 | 权限不足 | 需要 `slides:presentation:update` 或 `slides:presentation:write_only` |
references/cli/lark-slides-xml-presentation-slide-replace.md:175In the instructions
1. **parts 原子事务**：任一条失败整批回滚，不会出现"前几条成功、后几条失败"的中间态。2. **block_id 的获取**：`slide.get` 返回的 XML 里每个块（shape、img、table、chart 等）会带 3 位 short element ID，用这个值填 `block_id` / `insert_before_block_id`。

The presentation format supports images, tables, icons, embedded SVG, charts, and speaker notes; notes are shown only in presentation mode.

View source
references/xml/slides_xml_schema_definition.xml:1077In the instructions
            <xs:documentation>                单页幻灯片结构                子元素:                - style: 页面样式(背景色等), style的fill默认颜色为白色rgba(255, 255, 255, 1)                - data: 页面元素容器(shape/line/polyline/img/table/icon/embed/chart/undefined)                - note: 演讲者备注            </xs:documentation>
references/xml/slides_xml_schema_definition.xml:1115In the instructions
                    <xs:documentation>                        演讲者备注, 仅在演示模式显示                        支持完整的内容结构                        属性:

The Skill claims to use the required `lark-cli` to create, read, and edit slides, including page creation, deletion, and partial replacement operations that can change a remote presentation.

View source
SKILL.md:4In the instructions
version: 1.0.0description: "飞书幻灯片：创建和编辑幻灯片。创建演示文稿、读取幻灯片内容、管理幻灯片页面（创建、删除、读取、局部替换）。当用户需要创建或编辑幻灯片、读取或修改单个页面时使用。当用户给出 doubao.com 的 /slides/ URL/token 时，也应直接使用本 skill，不要因为域名不是飞书而回退到 WebFetch；路由依据是 URL 路径模式和 token，而不是域名。不负责：云文档内容编辑（走 lark-doc）、云文档里的独立画板对象（走 lark-whiteboard）、上传或下载普通文件（走 lark-drive）。"metadata:
SKILL.md:7In the instructions
  requires:    bins: ["lark-cli"]  cliHelp: "lark-cli slides --help"
Start here · InstructionsSKILL.md
lark-slides
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 1 more sections are available in the original file.

File reference map

References: 40
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records50 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • scripts/iconpark_tool_test.pyFull text included
  • scripts/iconpark_tool.pyFull text included
  • scripts/sxsd_validator.pyFull text included
  • scripts/xml_lint_test.pyFull text included
  • scripts/xml_lint.pyFull text included
  • scripts/xml_text_overlap_lint_test.pyFull text included
  • scripts/xml_text_overlap_lint.pyFull text included
  • references/asset-planning.mdFull text included
  • references/cli/lark-slides-add-slide.mdFull text included
  • references/cli/lark-slides-create.mdFull text included
  • references/cli/lark-slides-delete-slide.mdFull text included
  • references/cli/lark-slides-history.mdFull text included
  • references/cli/lark-slides-media-upload.mdFull text included
  • references/cli/lark-slides-replace-slide.mdFull text included
  • references/cli/lark-slides-screenshot.mdFull text included
  • references/cli/lark-slides-update-slide.mdFull text included
  • references/cli/lark-slides-xml-presentations-get.mdFull text included
  • references/planning-layer.mdFull text included
  • references/visual-planning.mdFull text included
  • references/workflow/error-handling.mdFull text included
  • references/workflow/slides-editing.mdFull text included
  • references/workflow/template-editing.mdFull text included
  • references/workflow/validation-xml.mdFull text included
  • references/xml/iconpark.mdFull text included
  • references/xml/slides_chart_demo.xmlFull text included
  • references/xml/slides_xml_schema_definition.xmlFull text included
  • references/xml/xml-schema-quick-ref.mdFull text included
  • references/cli/lark-slides-xml-presentation-slide-get.mdFull text included
  • references/cli/lark-slides-xml-presentation-slide-replace.mdFull text included
  • references/xml/iconpark-index.jsonFull text included
  • references/iconpark-index.jsonFull text included
  • references/iconpark.mdFull text included
  • references/lark-slides-add-slide.mdFull text included
  • references/lark-slides-create.mdFull text included
  • references/lark-slides-delete-slide.mdFull text included
  • references/lark-slides-edit-workflows.mdFull text included
  • references/lark-slides-history.mdFull text included
  • references/lark-slides-media-upload.mdFull text included
  • references/lark-slides-pptx-template-workflows.mdFull text included
  • references/lark-slides-replace-slide.mdFull text included
  • references/lark-slides-screenshot.mdFull text included
  • references/lark-slides-xml-presentation-slide-get.mdFull text included
  • references/lark-slides-xml-presentation-slide-replace.mdFull text included
  • references/lark-slides-xml-presentations-get.mdFull text included
  • references/slides_chart_demo.xmlFull text included
  • references/slides_xml_schema_definition.xmlFull text included
  • references/troubleshooting.mdFull text included
  • references/validation-checklist.mdFull text included
  • references/xml-schema-quick-ref.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/asset-planning.mdSupporting file
  • references/cli/lark-slides-add-slide.mdSupporting file
  • references/cli/lark-slides-create.mdSupporting file
  • references/cli/lark-slides-delete-slide.mdSupporting file
  • references/cli/lark-slides-history.mdSupporting file
  • references/cli/lark-slides-media-upload.mdSupporting file
  • references/cli/lark-slides-replace-slide.mdSupporting file
  • references/cli/lark-slides-screenshot.mdSupporting file
  • references/cli/lark-slides-update-slide.mdSupporting file
  • references/cli/lark-slides-xml-presentation-slide-get.mdSupporting file
  • references/cli/lark-slides-xml-presentation-slide-replace.mdSupporting file
  • references/cli/lark-slides-xml-presentations-get.mdSupporting file
  • references/iconpark-index.jsonSupporting file
  • references/iconpark.mdSupporting file
  • references/lark-slides-add-slide.mdSupporting file
  • references/lark-slides-create.mdSupporting file
  • references/lark-slides-delete-slide.mdSupporting file
  • references/lark-slides-edit-workflows.mdSupporting file
  • references/lark-slides-history.mdSupporting file
  • references/lark-slides-media-upload.mdSupporting file
  • references/lark-slides-pptx-template-workflows.mdSupporting file
  • references/lark-slides-replace-slide.mdSupporting file
  • references/lark-slides-screenshot.mdSupporting file
  • references/lark-slides-xml-presentation-slide-get.mdSupporting file
  • references/lark-slides-xml-presentation-slide-replace.mdSupporting file
  • references/lark-slides-xml-presentations-get.mdSupporting file
  • references/planning-layer.mdSupporting file
  • references/slides_chart_demo.xmlSupporting file
  • references/slides_xml_schema_definition.xmlSupporting file
  • references/troubleshooting.mdSupporting file
  • references/validation-checklist.mdSupporting file
  • references/visual-planning.mdSupporting file
  • references/workflow/error-handling.mdSupporting file
  • references/workflow/slides-editing.mdSupporting file
  • references/workflow/template-editing.mdSupporting file
  • references/workflow/validation-xml.mdSupporting file
  • references/xml-schema-quick-ref.mdSupporting file
  • references/xml/iconpark-index.jsonSupporting file
  • references/xml/iconpark.mdSupporting file
  • references/xml/slides_chart_demo.xmlSupporting file
  • references/xml/slides_xml_schema_definition.xmlSupporting file
  • references/xml/xml-schema-quick-ref.mdSupporting file
  • scripts/iconpark_tool.pyScript
  • scripts/iconpark_tool_test.pyScript
  • scripts/sxsd_validator.pyScript
  • scripts/xml_lint.pyScript
  • scripts/xml_lint_test.pyScript
  • scripts/xml_text_overlap_lint.pyScript
  • scripts/xml_text_overlap_lint_test.pyScript

Operations mentioned in code and instructions

Run commands
scripts/iconpark_tool_test.py:6In the code
import jsonimport subprocessimport sys
scripts/iconpark_tool_test.py:120In the code
class IconParkToolCLITest(unittest.TestCase):    def run_tool(self, *args: str) -> subprocess.CompletedProcess[str]:        return subprocess.run(
scripts/iconpark_tool_test.py:121In the code
    def run_tool(self, *args: str) -> subprocess.CompletedProcess[str]:        return subprocess.run(            [sys.executable, str(SCRIPT_PATH), *args],
Connect to websites
scripts/sxsd_validator.py:18In the code
XS_NS = "{http://www.w3.org/2001/XMLSchema}"SML_NAMESPACE = "https://www.larkoffice.com/sml/2.0"
scripts/sxsd_validator.py:19In the code
XS_NS = "{http://www.w3.org/2001/XMLSchema}"SML_NAMESPACE = "https://www.larkoffice.com/sml/2.0"SML_LEGACY_HTTP_NAMESPACE = "http://www.larkoffice.com/sml/2.0"
scripts/sxsd_validator.py:20In the code
SML_NAMESPACE = "https://www.larkoffice.com/sml/2.0"SML_LEGACY_HTTP_NAMESPACE = "http://www.larkoffice.com/sml/2.0"SML_READBACK_NAMESPACE = "/sml/2.0"
Read files
scripts/iconpark_tool.py:152In the code
    try:        index_data = json.loads(index_path.read_text(encoding="utf-8"))    except json.JSONDecodeError as error:
scripts/xml_lint.py:88In the code
def read_file(file_path: str | Path) -> str:    return Path(file_path).read_text(encoding="utf-8")
scripts/xml_lint.py:89In the code
def read_file(file_path: str | Path) -> str:    return Path(file_path).read_text(encoding="utf-8")
Change files
scripts/xml_lint_test.py:60In the code
            requested_path = temp_path / "requested.xml"            resolved_path.write_text(                '<presentation xmlns="https://www.larkoffice.com/sml/2.0" width="960" height="540">'
scripts/xml_lint_test.py:86In the code
            input_path = Path(temp_dir) / "invalid-slide.xml"            input_path.write_text(                """
scripts/xml_lint_test.py:3161In the code
                    input_path = Path(temp_dir) / f"{name}.xml"                    input_path.write_text(                        f"""
Lines read
55,459
File checksum (to compare versions)
c549755e9c6f00bc48cf970886c89369447cb1f8617cd5f917a1c1348177b831