The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses local Python scripts to automate multi-step DingTalk operations by executing the dws binary through subprocess.run(). This is observed in several scripts such as scripts/bulk_add_fields.py, scripts/import_records.py, and scripts/todo_batch_create.py. This behavior is legitimate and aligns with the skill's primary function as an administrative tool wrapper.
[PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection (Category 8). The agent has the capability to read content from various external and potentially untrusted sources, including DingTalk documents (doc read), emails (mail message get), and chat conversations (chat message list). Malicious instructions could be embedded in these sources to manipulate the agent's logic.
Ingestion points: Document reading (references/products/doc.md), email retrieval (references/products/mail.md), and chat message retrieval (references/products/chat.md).
Boundary markers: Absent. The skill does not provide specific instructions to the agent to disregard or delimit embedded instructions within the ingested content.
Capability inventory: The agent possesses broad capabilities, including sending messages (chat message send), modifying records (aitable record update), and managing organizational data, which could be abused if an injection succeeds.
Sanitization: Absent. There is no evidence of sanitization or filtering of external content before it is processed by the agent.

dws