lark-workflow-business-advisor
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources (such as CRM contact updates, social media tracker snapshots, task details, and calendar events) via lark-cli commands. Since this data is interpolated into the AI multi-role advisor prompts without explicit boundary markers or sanitization, there is a risk of indirect prompt injection if an external source contains malicious instructions.\n
- Ingestion Points: Data is collected from various Lark tables/APIs using
lark-cli base +record-list,lark-cli task +get-my-tasks, andlark-cli calendar +agendainsideSKILL.md.\n - Boundary Markers: Absent. No delimiters or instructions to ignore embedded commands are specified for the ingested data fields.\n
- Capability Inventory: The skill can execute multiple read/write actions including sending messages via
lark-cli im +messages-send, creating documents vialark-cli docs +create, and updating records vialark-cli base +record-upsert.\n - Sanitization: Absent. The ingested text fields are passed directly to the AI roles for analysis and aggregation.
Audit Metadata