The Agent Skills Directory

[PROMPT_INJECTION]: The instructions include an override directive ("CRITICAL — 开始前 MUST 先用 Read 工具读取...") designed to force the agent to execute specific file-reading tasks before starting the main workflow. This uses critical override language to bypass the agent's natural task planning.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates a data flow where untrusted content from external documents is processed and broadcast to other users, creating a surface for indirect attacks.
Ingestion points: Meeting content is retrieved from external documents using docs +fetch in Step 2, and meeting summaries are ingested via calendar events get in Step 1.
Boundary markers: No delimiters or instructions are provided to the agent to treat the fetched meeting notes as untrusted data or to ignore embedded instructions within them.
Capability inventory: The skill utilizes lark-cli im +messages-send which allows the agent to send arbitrary markdown messages to any user ID retrieved from the calendar event.
Sanitization: There is no evidence of content sanitization, filtering, or validation before the AI summarizes the text or before the final messages are dispatched to attendees and absentees.
[COMMAND_EXECUTION]: The skill relies on the execution of the lark-cli binary to perform authenticated operations. While these are the core functions of the skill, they involve the automated construction of shell commands using identifiers and content retrieved from remote Lark APIs.

lark-workflow-meeting-notes