lark-mail
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with external email communication data, creating a risk vector for indirect prompt injection attacks where malicious instructions could be embedded inside email bodies or subjects.
- Ingestion points: Incoming email content is ingested into the agent context through multiple commands such as
+message,+messages,+thread,+triage, and+watchinSKILL.mdand reference documents. - Boundary markers: The instructions explicitly include robust security rules advising the model to treat email text strictly as passive data and ignore embedded text imitating system commands. However, physical encapsulation delimiters (like XML tags) are not strictly specified within the prompt text.
- Capability inventory: The skill possesses powerful capabilities to manipulate email states, compose replies, forward content, or send new emails using the
lark-cliexecutable. - Sanitization: Strict multi-step operational guidelines require explicit user authorization before appending the
--confirm-sendflag or dispatching messages, effectively mitigating automated abuse paths.
Audit Metadata