The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from DingTalk IM, OA, and Todo events, creating a surface for indirect prompt injection where malicious instructions in message content could influence agent actions.\n
Ingestion points: Untrusted data enters the agent context via the stdout of dws event consume, which includes message content, reaction types, OA task titles, and Todo subjects (documented in SKILL.md and references/event-im-output.md).\n
Boundary markers: The output format is NDJSON, but the skill does not define specific prompt delimiters or instructions to treat embedded message content as untrusted.\n
Capability inventory: The agent is empowered to perform follow-up actions based on received events, such as sending messages (dws chat +messages-send), managing OA workflows (dws oa), and updating tasks (dws todo) (referenced in references/event-im-output.md, references/event-oa.md, and references/event-todo.md).\n
Sanitization: The instructions mitigate risks by directing the agent to use stable, machine-provided IDs (like conversation_id and task_id) rather than natural language search or display names for follow-up operations.\n- [SAFE]: The skill implements automated desensitization for sensitive data, specifically removing VoIP conference room codes from default flattened output to prevent accidental exposure (documented in references/event-voip.md).\n- [SAFE]: The skill manages its local state and rate-limiting data in a dedicated configuration directory (~/.dws/) using restrictive file permissions (0700 for directories and 0600 for files) to ensure local data integrity (identified in SKILL.md and references/event-im-operations.md).

dingtalk-event