slack-incident-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Python scripts using shell environment variables as the command dispatcher and script paths.
- Evidence: Found in
SKILL.mdin multiple phases:python3 $MCP_CALL "${PYATS_PYTHON:-python3} -u $PYATS_MCP_SCRIPT" pyats_ping_from_network_device. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests untrusted data from Slack channels and performs automated actions based on the context.
- Ingestion points: Reads channel and group history via the
channels:historyandgroups:historyOAuth scopes defined inSKILL.md. - Boundary markers: None identified in the skill instructions to delimit or warn against instructions embedded within Slack messages.
- Capability inventory: Can execute network diagnostics (
$PYATS_MCP_SCRIPT), create/update ServiceNow incidents, and write to Slack channels. - Sanitization: No sanitization logic is shown for the retrieved Slack history before it is processed by the agent.
- [DYNAMIC_EXECUTION]: The skill assembles execution commands at runtime using several environment variables, which determines the specific scripts being run.
- Evidence: Usage of
$MCP_CALL,$PYATS_MCP_SCRIPT,$SERVICENOW_MCP_SCRIPT, and$GAIT_MCP_SCRIPTthroughoutSKILL.md.
Audit Metadata