The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process data from external Feishu/Lark documents via lark-cli docs +fetch. These documents represent an untrusted data source that may contain malicious instructions aimed at overriding agent behavior. Given the skill's capabilities to modify documents and create new content (+update, +create, +media-insert), this creates an attack surface for indirect prompt injection.
Ingestion points: Document content retrieved via lark-cli docs +fetch and resource metadata.
Capability inventory: Extensive document modification, node creation, and media insertion via lark-cli subcommands.
Boundary markers: The skill relies on XML/Markdown structure but lacks explicit instructions for the agent to treat document content as purely passive data or to ignore embedded instructions.
Sanitization: XML entity escaping is mentioned in lark-doc-xml.md for format compliance, but no specific security sanitization for prompts is described.
[COMMAND_EXECUTION]: The skill relies on executing shell commands through the lark-cli binary. These commands incorporate user-supplied inputs such as document tokens and URLs. Notably, the reference documentation in lark-doc-fetch.md and lark-doc-resource-cover.md specifies strict security requirements for the CLI implementation to prevent SSRF (Server-Side Request Forgery), such as rejecting URLs with userinfo or hosts that resolve to private, loopback, or link-local IP addresses. Additionally, lark-doc-media-insert.md leverages platform-specific utilities (e.g., osascript, PowerShell, xclip) to interact with the system clipboard, which is expected behavior for the tool's intended use case.

lark-doc