The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted data from external records. 1. Ingestion points: The agent retrieves data from Lark Bitable tables using the lark-cli base +record-list command as seen in SKILL.md. 2. Boundary markers: There are no explicit instructions or delimiters used to separate data values from agent instructions, which could lead the agent to follow malicious commands embedded in record fields like product names or remarks. 3. Capability inventory: The skill is granted significant capabilities via lark-cli, including modifying and deleting records (+record-upsert, +record-delete) and sending interactive messages to Feishu groups (im +messages-send). 4. Sanitization: The instructions do not define any validation, filtering, or escaping steps for data retrieved from the tables before it is processed by the agent.

lark-workflow-erp-inventory