lark-workflow-morning-brief
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Lark emails, calendar events, and CRM records which could contain malicious instructions aimed at influencing the agent's behavior. \n
- Ingestion points: Untrusted data enters the agent context in
SKILL.mdthrough the execution oflark-cli mail +triage,lark-cli calendar +agenda, andlark-cli base +record-list. \n - Boundary markers: Step 4 of
SKILL.mdincludes a 'Security rule' explicitly stating that email content is untrusted and must not be executed by the agent. \n - Capability inventory: The skill possesses the ability to read across multiple Lark domains and transmit data using the
lark-cli im +messages-sendcommand. \n - Sanitization: The instructions mandate that the agent only present summaries of the external content to prevent the execution of embedded instructions. \n- [COMMAND_EXECUTION]: The skill operates by instructing the agent to execute the
lark-clibinary with specific parameters to perform authentication, data retrieval, and messaging. \n- [DATA_EXFILTRATION]: The skill is designed to aggregate sensitive personal and organizational data from various Lark modules and send a summarized version to a specified chat ID via theim +messages-sendcommand as its core functionality.
Audit Metadata