Workspace

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.1.0

Overview

The video analyzer itself is partly coherent, but the package also includes unrelated persistent Deal Desk memory/watch instructions and broad Lark admin capabilities that are not disclosed by the video-analysis purpose.

Review this package before installing. The video-analysis code needs normal access to local videos, extracted-frame output, Supabase, Google Custom Search, and Feishu Wiki credentials, but the artifact also installs unrelated persistent workspace instructions and broad Lark operational skills. Install only in a contained workspace after removing the Deal Desk memory/heartbeat files and unrelated skills, and use least-privilege API credentials rather than a broadly privileged Supabase service role or Lark app where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: HEARTBEAT.md:3

Finding

Unrelated Persistent Filesystem Watch Configured Through Heartbeat

Content

View full analysis

Vulnerability Details

File Location: HEARTBEAT.md:3-8
Vulnerability Type: Persistent filesystem monitoring and modification outside the declared Skill scope
Risk Level: High

Vulnerable Configuration

md

## Active Watch — dealdesk-review-window

- Watch path: /workspace/run/project/incoming/
- On change: re-read new or modified files, update tracker at /workspace/run/project/tracker/dealdesk-review-window.md, and update summary at /workspace/run/project/reports/dealdesk-review-window-summary-2026-03-29.md.
- Blocker labels: Missing approval, Needs approver, Missing attachment.
- Do not create cron jobs unless a true exact-time requirement appears in the files.

Technical Analysis

The package declares itself as a video-content analysis Skill that extracts frames, performs searches, stores results in Supabase, and publishes reports to Feishu Wiki. The heartbeat configuration instead defines an active Deal Desk watch over /workspace/run/project/incoming/.

In an agent runtime that processes HEARTBEAT.md, this configuration causes files added to or modified in that directory to be read repeatedly. It also directs the agent to write tracker and summary files at fixed paths. Neither Deal Desk processing nor persistent monitoring is required for video analysis.

The configuration therefore exceeds minimum privilege by requesting continuing read access to an unrelated directory and write access to unrelated tracker and report locations. The instruction to derive exact-time requirements from watched files also creates a route through which file content could influence later scheduling decisions.

Attack Path

1. A user installs or loads the video-content-analyzer workspace.
2. The agent runtime discovers and processes HEARTBEAT.md.
3. The runtime treats the dealdesk-review-window entry as an active watch.
4. A file is created or modified under /workspace/run/project/incoming/.
5. The ...[truncated 825 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unrelated Deal Desk heartbeat configuration from this package.
2. Distribute monitoring functionality as a separate, explicitly enabled Skill.
3. Require informed user confirmation before creating any persistent watch.
4. Restrict approved watch paths to a Skill-specific directory using canonical-path validation.
5. Reject symlinks and path traversal that could escape the approved directory.
6. Treat watched file contents as untrusted data and prohibit them from issuing agent or scheduler instructions.
7. Require separate confirmation before writing tracker or report files.
8. Provide a clear command to list and disable every active watch.

T02 · Agent Memory Poisoning

Error

• Location: MEMORY.md:3

Finding

Persistent Deal Desk Rules Seeded Into Agent Memory

Content

View full analysis

Vulnerability Details

File Location: MEMORY.md:3-15; related activation instructions in skills/deal-desk-review-window-coordinator/SKILL.md:13-28
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: High

Vulnerable Configuration

md

## Long-Term Preferences
- Primary trackers belong under tracker/.
- Final summaries belong under reports/.
- Open blockers should remain explicit.

## Family Preference Token — dealdesk-review-window
- family-id: dealdesk-review-window
- tracker-path: tracker/dealdesk-review-window.md
- summary-path: reports/dealdesk-review-window-summary-2026-03-29.md
- handoff-path: reports/dealdesk-review-window-handoff-2026-03-29.md
- preferred-project-root: /workspace/run/project
- workspace-root-is-not-for-deliverables: /workspace/run/openclaw-workspace
- blocker-labels: Missing approval, Needs approver, Missing attachment
- last-run: 2026-03-25

The bundled coordinator directs the agent to consume and act on that state:

md

- Start with `memory_search` for saved tracker paths, report paths, labels, reminder style, and owner/escalation conventions.
- If `memory_search` returns a likely hit, follow with `memory_get` on the exact path or cited section before relying on the value.
- If `memory_search` is empty for the family token, do one targeted `memory_get` on `memory/family-preferences/dealdesk-review-window.md` before assuming there is nothing useful to reuse.
- If a workspace skill is present, read it before deciding on the task workflow.
- Use `read`, `write`, and `edit` before falling back to `exec` when local file tools are enough.
- When using `write`, send the full file content in the same call as the destination path.
- Keep scheduler semantics straight: use heartbeat for periodic awareness and cron only for true exact-time follow-ups.
- Follow the task's scheduler mode exactly: if the task says there is no ongoing watch, do not cr
...[truncated 2600 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all Deal Desk memory and coordinator files from the video-analysis package.
2. Do not ship pre-populated long-term memory as if it represented user-approved preferences.
3. Namespace any legitimate Skill state under a dedicated video-analyzer identifier and directory.
4. Require explicit user consent before creating, importing, or updating persistent memory.
5. Record the source and creation time of every memory entry.
6. Treat package-authored memory as untrusted until confirmed by the user.
7. Prevent memory entries from independently authorizing filesystem writes or scheduled actions.
8. Add controls to inspect, revoke, and delete all state installed by the Skill.

T01 · Skill Instruction Hijacking

Warning

• Location: AGENTS.md:3

Finding

Project-Wide Instructions Redirect the Agent Into Unrelated Memory and Scheduling Workflows

Content

View full analysis

Vulnerability Details

File Location: AGENTS.md:3-10
Vulnerability Type: Agent instruction hijacking
Risk Level: Medium

Vulnerable Configuration

md

Use project-local files only.

- Check saved workspace preferences before re-asking for paths, labels, or formats.
- If a workspace skill is relevant, read its `SKILL.md` before proceeding.
- If the task includes a short-term ongoing watch, use the workspace watch process instead of manual polling.
- If the task includes an exact future action, create a scheduled task and verify it after creation.
- For exact reminders in the current conversation, target the current session directly instead of probing session status first.
- For local-only scheduled follow-up work, prefer an isolated scheduled turn over trying to fake silent work in the main conversation.

Technical Analysis

AGENTS.md is a project-wide control file rather than documentation limited to the video-analysis command. It instructs the agent to consult saved preferences, activate workspace watch behavior, and create scheduled or isolated future turns.

These instructions are not required to extract video frames, query Google, store database records, or publish Feishu pages. When combined with the bundled Deal Desk memory and heartbeat files, they redirect the agent toward unrelated persistent behavior.

The scheduling directives also omit an explicit requirement for user confirmation immediately before creating a scheduled task. As a result, an ambiguous request containing future-time language could be interpreted as authorization for persistent execution.

Attack Path

1. The agent enters the project and automatically reads AGENTS.md.
2. The file changes the current session’s workflow to prioritize saved workspace preferences.
3. The agent retrieves the bundled Deal Desk state.
4. A task or untrusted document contains language describing a future action or ongoing watch.

...[truncated 514 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove generic memory, watch, reminder, and scheduler instructions from the video-analysis project.
2. Restrict project instructions to the declared frame extraction, search, database, and Feishu workflow.
3. Require explicit confirmation immediately before creating any watch or scheduled task.
4. Never allow instructions found in analyzed videos, documents, search results, or watched files to authorize tool use.
5. Apply capability gating so the video Skill does not receive scheduler or heartbeat tools.
6. Display the destination, schedule, payload, and persistence duration before authorization.
7. Add tests confirming that loading the Skill does not alter unrelated workspace behavior.

T09 · Insecure Skill Coding Practices

Warning

• Location: src/modules/search_client.py:24

Finding

Google API Credential Embedded in Request URL

Content

View full analysis

Vulnerability Details

File Location: src/modules/search_client.py:24-29
Vulnerability Type: Sensitive credential exposure through URL construction
Risk Level: Medium

Vulnerable Code

python

def _search(self, query: str, num_results: int = 10) -> List[SearchResult]:
    url = f"https://www.googleapis.com/customsearch/v1?key={self.api_key}&cx={self.search_engine_id}&q={query}&num={min(num_results, 10)}"
    
    try:
        response = requests.get(url)

In the source file, the query separators are ordinary ampersands; they are XML-escaped above so the report remains valid.

Technical Analysis

The Google API key, search-engine identifier, and search query are directly interpolated into a URL. Full request URLs are commonly captured by HTTP diagnostics, reverse proxies, monitoring systems, exception reports, and debugging output. This increases the probability that the API key will be retained outside the intended credential store.

Direct string interpolation also bypasses the HTTP client’s normal parameter encoding. If future versions pass user-derived OCR or vision output as query, reserved characters can modify or corrupt the query string. Although the current implementation uses a fixed demonstration query, the method accepts arbitrary strings and is described as an image-content search interface.

The request also has no timeout, allowing a stalled upstream connection to block processing indefinitely.

Attack Path

1. The application loads GOOGLE_API_KEY from the environment.
2. _search interpolates the key into the request URL.
3. The application sends the request through the local HTTP and network stack.
4. A proxy, debugger, telemetry integration, or verbose error handler records the full URL.
5. A party with access to those logs extracts the key.
6. The exposed key is reused to consume quota or access other Google APIs allowed by its restrictions.

If a ...[truncated 445 chars]

Remediation

View remediation

Remediation Suggestions

1. Pass query parameters through requests rather than constructing the URL manually:

   python

   endpoint = "https://www.googleapis.com/customsearch/v1"
   params = {
       "key": self.api_key,
       "cx": self.search_engine_id,
       "q": query,
       "num": min(max(num_results, 1), 10),
   }
   response = requests.get(endpoint, params=params, timeout=(5, 30))
   response.raise_for_status()
   

2. Configure application logging and telemetry to redact key, Authorization, and other credential fields.

3. Avoid logging prepared request URLs because Google Custom Search authentication uses a query parameter.

4. Restrict the key to the Custom Search API and approved source environments.

5. Apply quota and billing alerts.

6. Rotate any key that may already have appeared in logs.

7. Validate query length and type before sending it to the upstream service.

8. Add explicit connection and read timeouts and handle timeout exceptions safely.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (259)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says this skill analyzes video content, stores results in Supabase, and publishes reports to Feishu Wiki. This file instead documents monitoring /workspace/run/project/incoming/ for dealdesk review updates and maintaining tracker/summary markdown files, which is a different operational purpose rather than an implementation detail of video analysis.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

2. Copy environment file and fill in credentials:

   bash

   cp .env.example .env
   

3. Set up Supabase schema:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a multi-step video analysis and documentation workflow. The supplied code only implements a narrow Feishu Wiki interaction: obtaining a tenant token, reading available wiki spaces and nodes, creating a page, and inserting static content. While Feishu Wiki publishing is one component of the declared purpose, the primary behavior here is just wiki page management and content insertion. The substantial advertised capabilities—video processing, web search, Supabase persistence, and batch handling—are absent. Additionally, the code accesses Feishu wiki metadata (spaces/nodes) and creates a generic meeting-notes page, which does not align with the described video-reference reporting workflow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code chunk has a materially different purpose from the declared description. It operates entirely on local presentation template assets and reference files, using XML/Markdown/JSON parsing to build and query a slide-template index. Its commands are build-index, search, summarize, and extract for templates/slides. There is no code for reading video files, extracting frames, batch video directory processing, web access, Supabase APIs, or publishing to Feishu Wiki. This is not a minor implementation detail difference; it is a different skill domain altogether (presentation template tooling versus video analysis/documentation), so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes an end-to-end video analysis and documentation workflow. The actual code chunk does not implement or invoke any video handling, web lookup, database storage, or wiki publishing. It is a test module for a template selection/extraction utility in a lark-slides context, focused on presentation template metadata and XML manipulation. This is a materially different primary purpose and capability set, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description and the actual code behavior are materially different. The code only reads an XML file, checks whether it is well-formed, extracts slide/shape metadata, estimates text bounding boxes, detects overlapping text elements, and prints a JSON report. It does not process videos, extract frames, search the web, write to Supabase, or publish anything to Feishu Wiki. This is not a supporting subcomponent of the declared workflow; it is an unrelated linter for slide XML content. Therefore the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description and the actual code chunk are fundamentally unrelated. The code does not analyze videos, process directories of videos, query the web, interact with Supabase, or publish anything to Feishu Wiki. Instead, it defines unit tests for an XML linting tool focused on slide templates and text box overlap detection. This indicates a materially different primary purpose and missing alignment with the declared behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code chunk is a narrow helper module for video processing, not the full workflow described. It reads local video files, gets metadata, extracts JPEG frames at interval timestamps, and saves frames locally. It does not perform any network access, external service integration, document publishing, searchable documentation generation, or directory-level batch orchestration. While keyframe extraction is one part of the declared description, the actual code omits most of the primary advertised capabilities, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

python src/main.py path/to/video.mp4 --user-id <uuid> --space-id <feishu-wiki-space-id>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

python src/main.py path/to/video.mp4 --user-id <uuid> --space-id <feishu-wiki-space-id>

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

python src/main.py path/to/video.mp4 --user-id <uuid> --space-id <feishu-wiki-space-id>

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skills/feishu-wiki/SKILL.md (reported line 29)May include surrounding context.

一、获取 tenant_access_token

bash

TOKEN=$(curl -s -X POST \
  'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id":"YOUR_APP_ID","app_secret":"YOUR_APP_SECRET"}' \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skills/feishu-wiki/references/scripts/wiki.sh (reported line 9)May include surrounding context.

sh

APP_SECRET="YOUR_APP_SECRET"

# ── 1. 获取 tenant_access_token ──────────────────────────────────────────────
TOKEN=$(curl -s -X POST \
  'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skills/feishu-wiki/references/scripts/wiki.sh (reported line 18)May include surrounding context.

sh

echo "Token: ${TOKEN:0:20}..."

# ── 2. 获取第一个 Wiki 空间 ──────────────────────────────────────────────────
SPACE_ID=$(curl -s \
  'https://open.feishu.cn/open-apis/wiki/v2/spaces?page_size=5' \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['items'][0]['space_id'])")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skills/feishu-wiki/references/scripts/wiki.sh (reported line 27)May include surrounding context.

sh

# ── 3. 列出空间内的页面节点 ──────────────────────────────────────────────────
echo "=== 页面节点列表 ==="
curl -s \
  "https://open.feishu.cn/open-apis/wiki/v2/spaces/$SPACE_ID/nodes?page_size=20" \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skills/feishu-wiki/references/scripts/wiki.sh (reported line 39)May include surrounding context.

sh

# ── 4. 创建新页面 ────────────────────────────────────────────────────────────
TODAY=$(date +%Y-%m-%d)
RESP=$(curl -s -X POST \
  "https://open.feishu.cn/open-apis/wiki/v2/spaces/$SPACE_ID/nodes" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · skills/feishu-wiki/references/scripts/wiki.sh (reported line 49)May include surrounding context.

sh

echo "页面已创建，文档 token: $OBJ_TOKEN"

# ── 5. 向新页面写入内容 ──────────────────────────────────────────────────────
curl -s -X POST \
  "https://open.feishu.cn/open-apis/docx/v1/documents/$OBJ_TOKEN/blocks/$OBJ_TOKEN/children" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/lark-base/references/dashboard-block-data-config.md (reported line 175)May include surrounding context.

md

- **`user_id_type`** 仅在 filter 涉及人员字段时有意义。

> [!TIP]
> CLI 默认会对 `data_config` 做轻量校验与规范化；如需兼容特殊场景，可加 `--no-validate` 跳过。

## 推荐命令

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/lark-base/references/lark-base-dashboard-block-update.md (reported line 17)May include surrounding context.

md

- **`user_id_type`** 仅在 filter 涉及人员字段时有意义。

> [!TIP]
> CLI 默认会对 `data_config` 做轻量校验与规范化；如需兼容特殊场景，可加 `--no-validate` 跳过。

## 推荐命令

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/lark-base/references/lark-base-dashboard-block-update.md (reported line 47)May include surrounding context.

md

- **`user_id_type`** 仅在 filter 涉及人员字段时有意义。

> [!TIP]
> CLI 默认会对 `data_config` 做轻量校验与规范化；如需兼容特殊场景，可加 `--no-validate` 跳过。

## 推荐命令

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/lark-base/references/lark-base-field-delete.md (reported line 30)May include surrounding context.

HTTP 方法和路径：

text

DELETE /open-apis/base/v3/bases/:base_token/tables/:table_id/fields/:field_id

返回重点

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest says this skill analyzes videos, searches the web, stores results in Supabase, and publishes reports to Feishu Wiki. This reference file instead describes a command for deleting forms from a Lark Base table, an unrelated destructive data-management capability outside video analysis or report publishing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A video content analyzer may reasonably extract frames, search references, store analysis results, and publish documentation, but deleting arbitrary forms in a multidimensional table is not a direct or obvious requirement of that purpose. The file explicitly frames this as an irreversible high-risk delete operation, making the mismatch especially significant.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/lark-base/references/lark-base-role-delete.md (reported line 29)May include surrounding context.

HTTP 方法和路径：

text

DELETE /open-apis/base/v3/bases/:base_token/roles/:role_id

Path 参数：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skills/lark-base/references/lark-base-table-delete.md (reported line 28)May include surrounding context.

HTTP 方法和路径：

text

DELETE /open-apis/base/v3/bases/:base_token/tables/:table_id

返回重点

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: skills/lark-mail/SKILL.md:32