lark-workflow-smart-scheduler
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches guidelines, shared configurations, and dependency documentation from the official Larksuite (ByteDance) GitHub repository.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external API sources, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: Data enters the agent's context through
lark-cli contact +search(user search results) andlark-cli calendar freebusy(calendar event data). - Boundary markers: Absent. There are no explicit delimiters or instructions provided to the agent to disregard instructions potentially embedded within the contact names or calendar titles.
- Capability inventory: The agent can perform network operations (via
lark-cli), read/write calendar events, search contact databases, and execute local date utilities. - Sanitization: The skill does not specify any sanitization or validation logic for the data retrieved from the Lark workspace before it is processed by the LLM.
Audit Metadata