lark-contact
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to take user-supplied data, such as names, email addresses, and IDs, and use them as parameters for shell commands executed via the
lark-cli. This creates an attack surface where a malicious user could attempt command injection if the agent fails to sanitize these inputs. - Ingestion points: The skill accepts untrusted strings through flags like
--query,--queries, and--user-ids, as documented inSKILL.mdand the reference files. - Boundary markers: The instructions do not specify the use of shell delimiters or prompt-based warnings to ignore embedded instructions within user-provided strings.
- Capability inventory: The skill utilizes shell execution capabilities to call various
lark-cli contactsubcommands. - Sanitization: No explicit input validation or escaping procedures are described in the documentation for handling potentially malicious character sequences in search queries.
Audit Metadata