lark-markdown
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the lark-cli binary to manage files in Lark/Feishu Drive. These operations (create, fetch, diff, patch, overwrite) are well-defined and scoped to the intended use case of cloud document management.\n- [EXTERNAL_DOWNLOADS]: The skill metadata points to github:larksuite/cli as its source and requires the lark-cli binary. This is documented as the official command-line interface for the Lark platform and represents a legitimate vendor dependency.\n- [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection because it processes untrusted Markdown content from external cloud storage.\n
- Ingestion points: Content retrieved from Lark Drive via lark-cli markdown +fetch or modified via +patch (referenced in SKILL.md and lark-markdown-fetch.md).\n
- Boundary markers: Absent; there are no instructions for the agent to use delimiters or ignore embedded instructions when processing file content.\n
- Capability inventory: The skill can read local files, write to local paths, and modify cloud resources via lark-cli.\n
- Sanitization: No sanitization is performed on the ingested Markdown content before it is placed into the agent's context.
Audit Metadata