The Agent Skills Directory

[SAFE]: The skill communicates only with official Slack API endpoints at https://slack.com/api. No unauthorized or suspicious third-party network requests were found in the codebase.- [SAFE]: Secure credential management is implemented in save_token.rb, which saves the Slack Bot Token to a local configuration directory (~/.config/slack/token) and explicitly sets file permissions to 0600 (owner-only access).- [SAFE]: The skill implementation uses a zero-dependency approach, relying exclusively on the Ruby standard library (json, net/http, uri, fileutils), which eliminates the risk of malicious third-party gem dependencies.- [SAFE]: Destructive or outgoing operations, including posting messages, pinning items, and uploading files, are documented to require explicit user confirmation before execution.- [PROMPT_INJECTION]: The skill exposes the agent to indirect prompt injection by processing untrusted data from the Slack workspace.
Ingestion points: Untrusted data enters the agent context through message history (messages.rb), search results (search_messages.rb), channel metadata (channel_info.rb), and user profiles (user_info.rb).
Boundary markers: The output from Slack is presented to the agent without explicit delimiters, markers, or warnings to distinguish external content from system instructions.
Capability inventory: The agent possesses capabilities to execute local Ruby scripts and perform write operations on the Slack workspace (posting, pinning, uploading), creating an escalation path if instructions embedded in messages are followed.
Sanitization: While the scripts remove newlines and truncate message text to 80 characters, they do not perform validation or filtering to identify and block natural language instructions intended to manipulate agent behavior.

slack