The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external XML data from Lark/Feishu presentations via the slides +xml-get shortcut. This represents a potential surface for indirect injection if a presentation contains malicious payloads.
Ingestion Points: Remote presentation content is retrieved via slides +xml-get and loaded into the agent context or local files.
Boundary Markers: The skill does not explicitly use markers to separate untrusted XML content within the prompt, but it enforces strict schema validation.
Capability Inventory: The agent can modify or delete documents using lark-cli based on the parsed data.
Sanitization: Employs a robust validation suite (scripts/xml_lint.py and scripts/sxsd_validator.py) to verify XML structure, schema compliance, and layout sanity before any creation or update operations.
[COMMAND_EXECUTION]: The skill includes Python scripts and test suites that execute local skill-provided files using the system's Python interpreter.
Evidence: scripts/iconpark_tool_test.py and scripts/xml_lint_test.py use subprocess.run to execute internal CLI utilities during testing.
Evidence: scripts/xml_text_overlap_lint.py acts as a proxy for the main linting logic.
[DYNAMIC_EXECUTION]: A compatibility script uses process replacement to delegate execution to a newer script version.
Evidence: scripts/xml_text_overlap_lint_test.py uses os.execv to execute xml_lint_test.py. This is a controlled use of process replacement targeting a known local file path.

lark-slides