The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources, specifically IM messages (im_message) and conversation traces (trace), which can contain untrusted content intended to influence the agent's behavior.
Ingestion points: External data enters the context via the dws dingtalk-tag run commands and the connect event consumer (documented in run.md and manage-and-connect.md).
Boundary markers: The instructions mention using --body-stdin and --employee-context to handle "restricted body text" and binding contexts, suggesting some separation (documented in SKILL.md).
Capability inventory: The skill has extensive file system access (uploads), network communication via the dws tool, and arbitrary command execution via --agent-cmd.
Sanitization: While the CLI is noted to perform internal validation (check_mcp), the instructions do not detail specific sanitization or escaping of the ingested message content before it is processed by the model.
[COMMAND_EXECUTION]: The skill makes heavy use of the dws CLI binary to perform administrative tasks, including creating, modifying, and deleting digital employees.
[DYNAMIC_EXECUTION]: The connect command supports a --agent-cmd flag for a "custom" channel, which executes a user-provided command and uses its standard output as the model's response. This represents a powerful dynamic execution surface (documented in manage-and-connect.md).
[DATA_EXFILTRATION]: The skill includes functionality to read local files (images for avatars, JSON for MCP configurations, and ZIP files for Skill resources) and upload them to a remote server via OpenAPI multipart requests (documented in capability.md and manage.md). While this is a core feature, it involves sending local data to an external endpoint.

dingtalk-tag