lark-workflow-knowledge-qa
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a RAG (Retrieval-Augmented Generation) workflow that ingests content from external documents via the Lark CLI and incorporates it into the agent's prompt context. This architecture provides a surface for indirect prompt injection if documents contain malicious instructions designed to influence the AI's response.
- Ingestion points: Document content is fetched using
lark-cli docs +fetchin Step 4. - Boundary markers: While the skill instructs the AI to base answers on document content, it lacks explicit structural delimiters or sanitization steps to isolate untrusted data.
- Capability inventory: The skill executes CLI commands for searching and reading workspace files.
- Sanitization: No content filtering is described before interpolation into the answer generation step.
- [EXTERNAL_DOWNLOADS]: The skill references shared skill definitions and official documentation hosted in the
larksuite/clirepository on GitHub. These references are used for authentication guidelines and command specifications. - [COMMAND_EXECUTION]: The skill uses the
lark-clitool to perform various operations, including searching wiki spaces and fetching document content, which are essential for its primary RAG functionality.
Audit Metadata