slack-block-kit-builder
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized network activity were detected across the skill's instructions, references, or scripts. The validation utility operates locally and interacts only with provided JSON files.\n- [COMMAND_EXECUTION]: The skill facilitates the execution of a bundled validation script (scripts/validate-block-kit.mjs) to verify payload structure. The script is a standard JavaScript utility that does not utilize external dependencies or perform privileged system operations.\n- [PROMPT_INJECTION]: The skill processes user-provided or external Slack Block Kit JSON payloads for structural validation, which represents an indirect prompt injection surface.\n
- Ingestion points: The validator script reads content from a file path or standard input specified by the user.\n
- Boundary markers: None explicitly defined in the instructions.\n
- Capability inventory: The script is limited to local file/stdin reading and console output; it does not possess network or file-write capabilities.\n
- Sanitization: The script parses input using standard JSON methods and performs strict validation against a list of known block types.
Audit Metadata