lark-workflow-doc-perm
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data which is then interpolated into command arguments and message templates without sanitization or boundary markers.
- Ingestion points: Document identifiers (URL/token), target usernames, and document titles provided by the user or external systems in
SKILL.md. - Boundary markers: Absent; there are no instructions or delimiters instructing the agent to ignore potentially malicious instructions embedded within document titles or user input fields.
- Capability inventory: The skill utilizes
lark-clito perform state-changing operations includingdrive permission.members create(modifying document access control) andim +messages-send(sending automated messages to other users). - Sanitization: Absent; the workflow directly passes extracted strings into command line arguments and notification markdown templates.
- [COMMAND_EXECUTION]: The skill relies on the execution of the
lark-clibinary to interact with the Lark/Feishu ecosystem. - Evidence: Multiple steps involve running shell commands like
lark-cli wiki spaces get_node,lark-cli contact +search-user, andlark-cli drive permission.members create. These are documented as the intended method for performing the skill's tasks.
Audit Metadata