The Agent Skills Directory

[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It reads content from external documents and chat messages using cmd_read and cmd_read_chat in feishu_doc.py and provides this untrusted data to the agent without sanitization or boundary markers. This is critical because the skill grants the agent extensive write and delete capabilities across the Feishu platform.
Ingestion points: feishu_doc.py (functions: cmd_read, cmd_read_chat, cmd_wiki_tree).
Boundary markers: None identified in SKILL.md or feishu_doc.py to separate untrusted data from instructions.
Capability inventory: feishu_doc.py (functions: cmd_create, cmd_append, cmd_overwrite, cmd_update_block, cmd_delete_block, cmd_notify, cmd_send).
Sanitization: No sanitization or filtering of input content is performed before processing.
[COMMAND_EXECUTION]: The skill invokes external CLI tools (feishu-docx) using subprocess.run in feishu_doc.py. While it correctly uses the list-based argument format to mitigate shell injection, it passes user-supplied URLs and directory paths directly to these external processes.
[CREDENTIALS_UNSAFE]: Authentication credentials, including the app_secret and generated OAuth access_token, are stored in plain text files (config.yaml and user_token.json) within the skill directory. This poses a risk if the environment where the skill is deployed is shared or insufficiently secured.

feishu-doc