The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to call platform-specific command-line interfaces such as lark-cli (for Feishu) and dws (for DingTalk).
Command arguments are passed as lists and the shell=False parameter is used consistently, which helps prevent command injection vulnerabilities.
These executions are central to the skill's primary function of publishing documents to third-party services.
[EXTERNAL_DOWNLOADS]: The skill downloads images from URLs extracted from documents to re-upload them to the target platforms.
It includes a _validate_public_image_url function that performs hostname resolution and checks the resulting IP addresses to ensure they are public, preventing Server-Side Request Forgery (SSRF) against private network resources.
[DATA_EXFILTRATION]: While the skill moves data between local files and external cloud platforms (Feishu, DingTalk, Notion), this behavior is the intended and primary purpose of the skill.
To protect sensitive information, the implementation includes a robust redact_sensitive utility that recursively scrubs credentials, tokens, and cookies from diagnostic manifests and log entries.
[DYNAMIC_EXECUTION]: In the DingTalk module, the skill uses importlib.import_module to load internal routing logic. This is safe as the module names are constrained by a fixed set of allowed route names (document, sheet, aitable) defined in an Enum.
[INDIRECT_PROMPT_INJECTION]: Because the skill processes untrusted document content, there is a risk of indirect prompt injection. However, the skill instructions specifically direct the AI agent to treat all parsed content as data and never execute instructions found within the documents.

pdf-online