lark-workflow-knowledge-base

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's required workflow (Step 1/Step 2) explicitly extracts arbitrary URLs from Feishu messages and then fetches/ingests content from open/public sources (e.g., "文章 URL", "YouTube 视频", "Twitter/X 推文", "PDF URL") which the agent reads and uses to generate summaries, tags, and drive saved-records/notifications, creating a clear path for untrusted third-party content to influence agent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly fetches arbitrary user-supplied external links at runtime (e.g., article/YouTube/Twitter/PDF URLs provided in chat) and injects the fetched content into the AI summarization/generation context, so those external URLs (user-supplied links) directly control the agent's prompts.