lark-workflow-meeting-finder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses high-urgency directives such as "CRITICAL" and "MUST" to override standard agent priority, specifically forcing the agent to read an external shared file (
lark-shared/SKILL.md) before beginning execution. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using the
lark-clitool to interact with contact and calendar services. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to command injection via user-supplied data because it interpolates untrusted input directly into shell command arguments.
- Ingestion points: User-provided strings for participant names and meeting summaries are ingested into the workflow (e.g., the
--queryand--summaryflags). - Boundary markers: There are no boundary markers or instructions to the agent to escape or treat these inputs as literal data.
- Capability inventory: The skill uses
lark-clito search contacts, query private schedule data, and create calendar events. - Sanitization: No sanitization, validation, or escaping logic is provided to handle potentially malicious shell characters in user inputs.
Audit Metadata