lark-workflow-personal-crm
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, introducing a potential vulnerability surface for indirect prompt injection attacks.
- Ingestion points: External content is fetched using
mail +messages(email body and subject) andcalendar +agenda(meeting participants and titles) withinSKILL.md. - Boundary markers: Absent. The prompt instructions do not specify any delimiters or instructions for the model to isolate and ignore potential system override instructions embedded in the emails or calendar content.
- Capability inventory: The skill possesses capabilities to write and update data inside Lark Bitables (
base +record-upsert) and broadcast automated updates using Feishu messaging (im +messages-send). - Sanitization: Absent. The instructions do not prescribe input filtering or schema compliance checks on raw text blocks prior to the model summarizing or generating keywords from them.
Audit Metadata