lark-workflow-health-diary
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from user messages (text descriptions and food photos) which are then processed by the AI to identify correlations and generate advice. An attacker could potentially embed instructions in their health updates to influence the agent's behavior.
- Ingestion points: Feishu messages retrieved via
lark-cli im +messages-resources-downloadand text inputs processed in "Mode 1" and "Mode 2". - Boundary markers: No explicit delimiters or instructions are provided to the AI to ignore instructions embedded within the user data.
- Capability inventory: The skill can perform file writes (upsert records in Lark Base), send messages via IM, and create documents.
- Sanitization: The workflow does not specify any sanitization or validation of the input data before it is interpolated into AI prompts.
- [COMMAND_EXECUTION]: The skill relies heavily on the
lark-clibinary to interact with the Lark platform. It executes multiple shell commands with parameters derived from user interactions and AI analysis, which represents a standard but broad attack surface for command-oriented skills.
Audit Metadata