lark-workflow-chat-digest

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches user-generated group chat content via "im +chat-messages-list" (Step 2) and then "将拉取到的消息交给 AI 分析" (Step 3) to drive generation, decisions, and optional sending/saving actions, so untrusted third-party messages can materially influence agent behavior.