lark-workflow-meeting-summary
会议纪要整理工作流：汇总指定时间范围内的会议纪要并生成结构化报告。当用户需要整理会议纪要、生成会议周报、回顾一段时间内的会议内容时使用。
77
100%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
该工作流在 Step 3/Step 4 通过 `note +detail` 与 `drive metas batch_query --with_url true` 获取并在生成“结构化报告/文档”时读取会议纪要（来自用户账号中的会议文档正文）——这些纪要正文是由会议参与者/他人撰写的外部内容，因此存在将“outsider-authored free text”（纪要/逐字稿正文）注入LLM上下文的路径。
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill requires reading external skill files at runtime (../lark-shared/SKILL.md and ../lark-vc/SKILL.md) and explicitly mandates reading ../lark-vc/references/vc-domain-boundaries.md, which are runtime-fetched documents that directly control authentication/permission handling and agent decision logic.
- Repository
- larksuite/cli
- Commit
a7865cd
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.