The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from DingTalk messages and threads, creating a surface for indirect prompt injection. \n
Ingestion points: Untrusted content enters the agent context via message reading and searching commands such as dws chat +chat-messages, +search-msg, and +thread-replies located in references/chat/message-query.md and references/chat/thread.md. \n
Boundary markers: The SKILL.md file defines a 'Runtime Contract' that mandates structured data reading using --format json and explicit verification of results to prevent misinterpretation of malformed or malicious data. \n
Capability inventory: The skill possesses significant capabilities across all its scripts, including sending messages, creating and managing groups, and writing to the local file system using the --output and --download-resources flags (as seen in references/01-messaging.md and references/chat/message-media.md). \n
Sanitization: The instructions do not define specific sanitization or escaping protocols for the processed text, relying on the agent's internal safety guardrails and the structured nature of the CLI output.

dingtalk-chat