The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill allows the agent to ingest untrusted data from external sources, specifically Lark chat messages and system events, which could contain malicious prompts.
Ingestion points: Untrusted data enters the agent context through the lark-cli event +subscribe command, which streams real-time events like im.message.receive_v1 (chat messages) to stdout.
Boundary markers: The provided examples do not demonstrate the use of delimiters or specific instructions to the AI to ignore embedded commands within the message content.
Capability inventory: While the skill itself is labeled as read-only, its primary purpose is to feed data into an agent pipeline that typically includes capabilities like replying to messages (lark-cli api POST .../reply) or updating documents (lark-cli docs +update), as shown in the documentation examples.
Sanitization: The skill provides a --compact flag to flatten JSON structures and strip metadata, but it does not perform semantic filtering or sanitization of the actual message text before it reaches the AI.
[COMMAND_EXECUTION]: The skill utilizes the lark-cli binary to perform its tasks.
The commands include lark-cli event +subscribe with various flags like --filter, --output-dir, and --route for handling data flow.
These actions are consistent with the skill's stated purpose of providing a WebSocket listener for the Lark platform.

lark-event