lark-wiki
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses high-priority directive language ("CRITICAL", "MUST") to command the agent to read an external configuration file (
../lark-shared/SKILL.md) before execution. This pattern is commonly associated with instructional overrides and bypass techniques. - [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface where it ingests data from external wiki nodes which could contain malicious instructions.
- Ingestion points: The
get_nodemethod inSKILL.mdretrieves content from the Lark Wiki environment. - Boundary markers: None are defined to separate the fetched content from the agent's instructions.
- Capability inventory: The skill has the capability to execute shell commands via the
lark-clitool. - Sanitization: There is no mention of sanitization or filtering of the content retrieved from the wiki nodes.
- [COMMAND_EXECUTION]: The skill uses a local binary,
lark-cli, to interact with the Lark API. This is a standard functional requirement for the skill's purpose but represents a privileged capability.
Audit Metadata