The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides numerous methods for the agent to ingest untrusted data from external chat messages, creating a surface for indirect prompt injection attacks.
Ingestion points: Commands such as +chat-messages-list, +threads-messages-list, +messages-mget, and +messages-search retrieve message content and metadata from the Lark platform.
Boundary markers: The instructions lack specific guidance on using delimiters or strict formatting to isolate untrusted data from the agent's internal reasoning or system instructions.
Capability inventory: The agent possesses powerful capabilities through lark-cli, including sending messages, managing group memberships, updating chat configurations, and downloading files to the local system.
Sanitization: No explicit sanitization or instruction-filtering mechanisms are defined for processing the ingested message text before the agent acts upon it.
[COMMAND_EXECUTION]: The core functionality of the skill is built around executing shell commands via the lark-cli utility. The instructions guide the agent to interpolate various IDs, user-provided text, and file paths into these commands. This is consistent with the intended purpose of the skill as a developer tool.
[EXTERNAL_DOWNLOADS]: The skill enables the agent to download message attachments (images, files, audio, and video) from Lark servers.
Evidence: The +messages-resources-download command and the --download-resources flag in listing shortcuts are used to save binary data to the local filesystem.
Mitigation: The skill documentation (e.g., in references/lark-im-messages-resources-download.md) mentions security controls that restrict output paths to allowed directories like /tmp or the current working directory, preventing writes to sensitive system locations.

lark-im