The Agent Skills Directory

[SAFE]: The skill facilitates legitimate management of Lark/Feishu OKRs using the official lark-cli utility. The instructions are clear, documented, and do not contain any obfuscated code or unauthorized network operations.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text for OKR content and progress reports, which is a standard surface for indirect prompt injection. However, the risk is minimized by the skill's specific focus on structured OKR data and the underlying platform's access controls.
Ingestion points: User input provided via the --input and --content flags in SKILL.md and associated reference files (e.g., references/lark-okr-batch-create.md, references/lark-okr-progress-create.md).
Boundary markers: Not explicitly present in the command templates, but the use of JSON structures for content blocks provides natural data/instruction separation.
Capability inventory: File reading for image uploads (restricted to relative paths in references/lark-okr-image-upload.md), and network operations via lark-cli to interact with the Lark OKR API.
Sanitization: The skill relies on the lark-cli tool and the Lark API for data validation and sanitization.- [COMMAND_EXECUTION]: The skill executes lark-cli commands, which is the intended and documented behavior for this integration. The documentation explicitly warns against using absolute paths for file uploads, mitigating potential path traversal or sensitive file exposure risks.

lark-okr