lark-workflow-calendar-optimizer
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
lark-clitool to interact with the Lark/Feishu calendar API. It performs read operations (+agenda) and state-changing operations (+update,delete,+rsvp). While these tools have significant capabilities, the skill explicitly includes safety rules requiring user confirmation before any destructive or modification actions are executed. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted external data.
- Ingestion points: Data enters the agent context through the
lark-cli calendar +agendacommand inSKILL.md(Step 1), which retrieves event titles, descriptions, and locations. - Boundary markers: The instructions do not define clear delimiters or specific 'ignore embedded instructions' warnings for the data being analyzed.
- Capability inventory: The skill has the capability to modify or delete calendar events using
lark-cli calendar +update,lark-cli calendar events delete, andlark-cli calendar +rsvp(SKILL.md Step 4). - Sanitization: There is no mention of sanitizing or escaping the event data before it is analyzed by the '日程分析引擎' (Analysis Engine). A malicious actor could craft a calendar event title containing instructions to bypass the optimization logic or attempt to influence the agent's summary output.
Audit Metadata