lark-workflow-announce
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The workflow ingests untrusted user input, such as group names and announcement content, which is directly interpolated into CLI commands and API request bodies. A malicious user could attempt to influence the agent's behavior through these input fields.
- Ingestion points: User-provided group names in Step 1 and announcement content in Step 3 of SKILL.md.
- Boundary markers: Absent. The skill does not define specific delimiters or instructions for the agent to ignore instructions embedded within the user data.
- Capability inventory: The skill uses
lark-clito search for chats, read/modify group announcements, and send messages to group chats. - Sanitization: Absent. There are no instructions to sanitize user input for shell metacharacters or to validate the HTML content against a safe schema before submission to the Lark API.
- [COMMAND_EXECUTION]: The skill relies on the execution of the
lark-clibinary. It constructs command strings using variables derived from user input (e.g.,--query "<群名称>"), which presents a risk of command injection if the underlying execution environment does not properly handle shell escaping.
Audit Metadata