The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection because it ingests untrusted data from DingTalk chat messages and search results.
Ingestion points: Documentation in references/chat/message-query.md and references/01-messaging.md outlines commands such as dws chat +chat-messages, +search-msg, and message list-all that pull external chat history and metadata into the agent's context.
Boundary markers: The instructions do not define specific delimiters or instructions to the agent to disregard commands embedded within the retrieved chat messages, increasing the risk of the agent obeying malicious content.
Capability inventory: The skill has broad administrative and messaging capabilities, including dws chat +chat-create (group creation), dws chat +dm (sending direct messages), and various group management functions in references/chat/group-admin.md such as modifying roles and settings.
Sanitization: No specific sanitization or filtering logic is prescribed for the chat content before it is processed by the agent.

dingtalk-chat