The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted content from Slack messages and threads while maintaining write capabilities.
Ingestion points: External data is brought into the agent's context through methods like messages.read, channels.read, search.read, and canvases.read as defined in manifest.yaml and SKILL.md.
Boundary markers: The manifest.yaml configuration enforces an ask policy for all write/mutation methods (e.g., messages.send, conversations.create), requiring the user to review an approval_phrase before the action is executed.
Capability inventory: The skill utilizes an environment-provided slack CLI binary to perform operations including message delivery, scheduling, channel creation, and reaction management.
Sanitization: No explicit input sanitization of Slack content is described in the manifest; however, the skill logic restricts the agent to a 'reviewed subset' of tools and prevents access to unreviewed mutations or signed URLs.

slack