lark-workflow-meeting-efficiency

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes meeting titles, attendee information, and meeting notes from the Lark/Feishu platform which are controlled by external users.
  • Ingestion points: Data is retrieved from the workspace via lark-cli calendar +agenda, lark-cli vc +search, and lark-cli minutes search commands.
  • Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore instructions that might be embedded in meeting titles or notes.
  • Capability inventory: The skill's primary function is generating a summary report. It does not perform sensitive file writes or exfiltrate data to non-authorized network endpoints.
  • Sanitization: There is no evidence of sanitization or filtering of external meeting content before it is included in the efficiency report.
  • [EXTERNAL_DOWNLOADS]: The skill references shared security rules, authentication guidelines, and technical documentation located in the official Larksuite GitHub organization repositories.
  • [COMMAND_EXECUTION]: The skill invokes the lark-cli binary to interface with calendar and video conferencing APIs. It also utilizes the system date command to perform calculations for analysis time ranges.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 04:50 AM