The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of data from external Lark Bitable sources, including records, table structures, and automation workflows. This creates an attack surface where malicious instructions could be embedded in the data processed by the agent.
Ingestion points: Data is retrieved from external sources using commands such as +record-list, +record-get, +data-query, and +workflow-get across various reference files.
Boundary markers: The instructions provide usage constraints but do not specify the use of delimiters or 'ignore' instructions when interpolating retrieved record data into prompts.
Capability inventory: The agent utilizes the lark-cli binary to perform extensive operations, including creating workflows, modifying records, and managing table schemas. These actions involve network operations and potentially local file access (e.g., via the @file.json syntax).
Sanitization: There are no explicit instructions for the agent to sanitize or validate external string content fetched from the Bitable before processing.
[COMMAND_EXECUTION]: The skill functions by executing shell commands via the lark-cli tool. While this is the intended functionality, it involves the interpolation of user-provided tokens (base tokens, table IDs) and complex JSON payloads into shell execution strings, representing a persistent command injection surface if inputs are not properly handled by the underlying agent platform.

lark-base