The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata from the Lark/Feishu directory service that could be used for indirect prompt injection attacks.
Ingestion points: Data retrieved from lark-cli contact +search-user, +search-bot, and +get-user, including fields like localized_name, description, department, and signature (found in SKILL.md and reference files).
Boundary markers: The skill lacks explicit instructions for the agent to use prompt delimiters or sanitization when processing this external metadata, though it warns against automatically selecting results for actions with side effects.
Capability inventory: The skill utilizes lark-cli for directory searches and information retrieval; the resulting identifiers (like open_id) are intended for use in communication tools like lark-im.
Sanitization: No specific sanitization or escaping of the retrieved contact metadata is mentioned before it is processed by the agent.

lark-contact