The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external email data, including subjects and bodies, which constitutes an attack surface for indirect prompt injection from malicious senders.
Ingestion points: Untrusted data enters the agent's context through several commands including +message, +messages, +thread, +triage, and +watch.
Boundary markers: The skill contains explicit, high-priority safety instructions in SKILL.md that command the agent to ignore any "instructions" found within email content and to treat that content strictly as data.
Capability inventory: The agent possesses write capabilities such as sending emails (+send, +reply), deleting messages (+message-trash), and managing mailbox rules.
Sanitization: The skill includes a dedicated HTML linting tool (+lint-html) and enforces internal sanitization via emlbuilder for all outgoing email content to mitigate XSS and injection risks.
[SAFE]: The skill is associated with the official Larksuite CLI (lark-cli) and targets a trusted organization's infrastructure, following the trust scope rules for established vendors.
[SAFE]: The instructions implement a "confirmation-first" policy for all high-risk write operations, ensuring that the agent cannot perform destructive or external-facing actions without explicit user approval.

lark-mail