skills/yugasun/skills/nice-lark-doc/Gen Agent Trust Hub

nice-lark-doc

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs necessary official CLI tools and agent extensions.
  • scripts/setup.sh installs the @larksuiteoapi/cli package globally via npm.
  • The setup script also uses npx skills add to fetch and install skills from the larksuite/cli repository.
  • [COMMAND_EXECUTION]: Shell scripts are employed for dependency management and environment verification.
  • scripts/setup.sh and scripts/check-deps.sh execute commands like npm install, npx skills, and lark-cli auth status to ensure the runtime environment is properly configured.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content which presents a potential injection surface.
  • Ingestion points: The skill reads existing content from Lark documents provided by the user during the 'Beautify' workflow (specified in SKILL.md).
  • Boundary markers: Absent. The skill does not explicitly use delimiters to separate user content from system instructions in its prompt generation logic.
  • Capability inventory: Includes the ability to create and update Lark documents and manage whiteboards via lark-cli subprocess calls.
  • Sanitization: Absent. Content is reformatted according to style recipes (e.g., editorial-clean.md) without explicit sanitization of embedded instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 05:53 AM