Lianke Print Box

PassAudited by ClawScan on May 1, 2026.

Overview

The skill’s instructions match its Lianke cloud printing/scanning purpose, but users should verify the CLI source, protect device credentials, and only run print or scan actions they intend.

Before installing, verify the GitHub repository or pin a trusted release, use protected and revocable Lianke credentials where possible, and confirm each print, scan, cancel, or delete action before running it.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An accidental or wrong command could print the wrong file, consume supplies, scan at the wrong time, or delete a scan task.

Why it was flagged

These documented CLI commands can create or cancel remote print jobs and create or delete scan jobs. That is purpose-aligned, but it can affect a real device and document tasks.

Skill content
lk-print print /path/to/file.pdf ... lk-print cancel-job <task_id> ... lk-print scan <scanner_id> ... lk-print scan-delete <task_id>
Recommendation

Confirm the target file or URL, printer/scanner ID, print settings, and task ID before running action commands.

What this means

Anyone with these credentials may be able to operate or query the associated Lianke print box.

Why it was flagged

The skill requires cloud/device credentials for authentication. This is expected for Lianke device control, but users should recognize that these secrets grant access to the device account.

Skill content
lk-print auth --api-key <YOUR_API_KEY> --device-id <YOUR_DEVICE_ID> --device-key <YOUR_DEVICE_KEY>
Recommendation

Use only trusted installations, avoid sharing the credentials, and prefer revocable or least-privilege keys if the Lianke service supports them.

What this means

The code installed later could differ from what the user expected if the repository changes.

Why it was flagged

Installation pulls an executable CLI from a GitHub URL without a pinned commit or version in the instructions. This is disclosed, but it leaves the installed code dependent on the remote repository state.

Skill content
uv tool install git+https://github.com/liankenet/lk-print-box.git
Recommendation

Verify the repository owner and contents before installing, and pin to a trusted release or commit when possible.

What this means

Private documents may be sent to or retrieved through the Lianke cloud printing workflow.

Why it was flagged

The skill is for remote cloud printing and scanning, including local files. That implies document contents or scan results may cross the CLI/cloud/device boundary, although the artifact does not detail retention or handling.

Skill content
通过 `lk-print` CLI 操作链科云打印盒,远程控制打印机和扫描仪。 ... lk-print print /path/to/file.pdf
Recommendation

Use this only for documents appropriate for the Lianke service and review the provider’s privacy and retention practices if handling sensitive material.