lark-wiki
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the Lark Wiki API, such as node titles, space names, and descriptions. This creates a potential surface for indirect prompt injection if an attacker embeds malicious instructions within those fields. However, the skill provides robust mitigations to handle this risk safely.\n
- Ingestion points: Untrusted data enters the agent context through various listing and retrieval commands, such as
lark-cli wiki spaces listinSKILL.mdandlark-cli wiki +node-getinreferences/lark-wiki-node-get.md.\n - Boundary markers: The instructions consistently require the agent to use the
--format jsonflag for tool outputs, ensuring that data is processed in a structured manner rather than as free-flowing text.\n - Capability inventory: The skill has significant capabilities, including deleting entire knowledge spaces (
+delete-space), deleting nodes (+node-delete), and removing space members (+member-remove).\n - Sanitization: The skill mandates a strict human-in-the-loop process for all high-risk actions. For instance, in
lark-wiki-delete-space.md, the agent is prohibited from automatic execution based on name matches; it must present a list of candidates to the user and wait for an explicit selection of aspace_id. Additionally, destructive commands require a manual--yesconfirmation flag to execute.
Audit Metadata