The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted chat data from the Lark platform, creating a risk that malicious instructions embedded in those messages could influence the agent's behavior.
Ingestion points: The lark-cli im +chat-messages-list command in SKILL.md fetches external chat content into the agent's context.
Boundary markers: The instructions do not define delimiters (e.g., XML tags or triple quotes) or include "ignore" directives to separate the AI's processing logic from the potentially untrusted content of the chat messages.
Capability inventory: The skill includes capabilities to send messages (lark-cli im +messages-send) and create documents (lark-cli docs +create).
Sanitization: There is no mention of filtering, escaping, or validating the chat content before it is processed by the AI or output to other tools.
[PROMPT_INJECTION]: The instructions include high-priority override directives aimed at the agent.
Evidence: The header CRITICAL — 开始前 MUST 先用 Read 工具读取 [../lark-shared/SKILL.md] uses patterns typical of behavior overrides to force the agent into a specific execution path before proceeding.
[COMMAND_EXECUTION]: The workflow requires executing a local binary with parameters derived from external user inputs.
Evidence: The agent is instructed to pass user-provided strings, such as chat names (--query "<群名称>") and page tokens, directly into shell commands for the lark-cli tool.

lark-workflow-chat-digest