lark-workflow-crm
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text data from customer inputs, follow-up records, and public form submissions (e.g., fields like '客户名称', '跟进摘要', '客户反馈') which are handled by the agent during automated workflows such as generating daily reports or sending notifications.
- Ingestion points: Data input via CRM record management (Phase 2, Phase 4) and customer query forms (Phase 7).
- Boundary markers: Absent. There are no explicit boundaries or instructions provided to isolate or escape content from these fields before processing.
- Capability inventory: Executes lark-cli commands to interact with Feishu Bitable applications and send instant messages (lark-cli im +messages-send). It does not possess shell execution or arbitrary file write capabilities.
- Sanitization: Absent. Input is processed directly as text into Bitable fields and interpolated into notifications.
Audit Metadata