The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches content from external Feishu entities (Docs, Wiki, Sheets, Bitable) and returns it to the agent, creating a surface for instructions embedded in those documents to influence agent behavior.
Ingestion points: readDoc in index.js, fetchDocxContent in lib/docx.js, fetchBitableContent in lib/bitable.js, and fetchSheetContent in lib/sheet.js.
Boundary markers: Absent. Fetched content is converted to Markdown and returned without explicit delimiters or warnings to the agent regarding third-party content.
Capability inventory: The skill possesses significant capabilities including overwriting documents (writeDoc), appending content (appendDoc), and granting edit permissions to other users (grantPermission in create.js).
Sanitization: Sanitization logic in input_guard.js is focused on preventing API errors during write operations and does not sanitize incoming data for prompt injection patterns.
[CREDENTIALS_UNSAFE]: Utility scripts designed for setup and inspection contain hardcoded resource identifiers.
Evidence: inspect_meta.js and setup_iter11.js contain hardcoded app tokens (X8QPbUQdValKN7sFIwfcsy8fnEh, LvlAbvfzMaxUP8sGOEWcLrX7nHb) and table IDs. While these are identifiers rather than secrets like app_secret, hardcoding specific target resources in the skill distribution is a minor data exposure risk.

feishu-doc