lark-approval
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes data from external approval systems and possesses the capability to perform state-changing actions. Although the vulnerability exists, it is inherent to the business purpose of the skill.
- Ingestion points: External data enters the agent context via
lark-cli approval tasks query(references/lark-approval-tasks-query.md) andlark-cli approval instances get(references/lark-approval-instances-get.md). - Boundary markers: The instructions lack explicit delimiters or specific warnings to the model to ignore instructions potentially embedded within the retrieved approval data (e.g., in approval comments or form fields).
- Capability inventory: The skill supports several subprocess calls that modify external state, including
tasks approve,tasks reject,tasks transfer,tasks rollback, andinstances create(SKILL.md). - Sanitization: The instructions do not specify any sanitization or validation logic for data retrieved from the API before it is utilized in subsequent prompts.
Audit Metadata