lark-workflow-meeting-efficiency
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes meeting titles, attendee information, and meeting notes from the Lark/Feishu platform which are controlled by external users.
- Ingestion points: Data is retrieved from the workspace via
lark-cli calendar +agenda,lark-cli vc +search, andlark-cli minutes searchcommands. - Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore instructions that might be embedded in meeting titles or notes.
- Capability inventory: The skill's primary function is generating a summary report. It does not perform sensitive file writes or exfiltrate data to non-authorized network endpoints.
- Sanitization: There is no evidence of sanitization or filtering of external meeting content before it is included in the efficiency report.
- [EXTERNAL_DOWNLOADS]: The skill references shared security rules, authentication guidelines, and technical documentation located in the official Larksuite GitHub organization repositories.
- [COMMAND_EXECUTION]: The skill invokes the
lark-clibinary to interface with calendar and video conferencing APIs. It also utilizes the systemdatecommand to perform calculations for analysis time ranges.
Audit Metadata