The Agent Skills Directory

[COMMAND_EXECUTION]: Several Python scripts, including import_records.py, upload_attachment.py, and aitable_export_via_task.py, utilize the subprocess module to execute the dws CLI binary. This is a legitimate integration method to perform table operations and does not pose a security risk in this context as the commands are constructed from validated parameters.
[EXTERNAL_DOWNLOADS]: The skill performs targeted network requests using the urllib library to upload attachments to DingTalk's storage and download exported table data. These operations are restricted to endpoints provided dynamically by the DingTalk service during the execution of table management tasks.
[PROMPT_INJECTION]: The skill processes external data sources such as CSV and JSON files which could theoretically contain malicious instructions (indirect prompt injection). 1. Ingestion points: import_records.py (CSV/JSON files), aitable_import_via_task.py (Excel/CSV files), and table data retrieved via record query. 2. Boundary markers: None identified in the script logic for raw data parsing. 3. Capability inventory: Subprocess execution of dws for table modifications and file exports. 4. Sanitization: Basic value normalization and whitespace trimming are performed in the import scripts.

dingtalk-aitable