The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (user-supplied text and titles) and reads external content (existing slide XML via the server). However, it employs a robust defense-in-depth strategy by requiring the use of a local validation tool (scripts/xml_lint.py) before submitting any content. This tool checks for schema compliance and layout issues, effectively mitigating risks associated with malformed or injected content in the XML structure.
[COMMAND_EXECUTION]: The skill uses the lark-cli tool to perform its operations. While it includes Python scripts (xml_lint.py, iconpark_tool.py) that perform local processing, these scripts are part of the skill's own package and are used for validation and asset lookups rather than arbitrary command execution. Static analysis flags in test files (xml_lint_test.py) are associated with standard testing procedures and do not pose a threat to the user environment.
[DATA_EXFILTRATION]: The skill performs legitimate network operations via lark-cli to interact with the Lark Slides service. The instructions include a procedure for handling external images by downloading them locally before uploading them to the platform. No unauthorized data access or exfiltration patterns were identified.
[DYNAMIC_EXECUTION]: The presence of os.execv in scripts/xml_text_overlap_lint_test.py is a compatibility shim used to wrap the main test suite. This is a benign implementation detail for managing script execution during development and testing.

lark-slides