slack-workflows
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill is designed to ingest and process data from multiple external and untrusted sources to automate Slack workflows.
- Ingestion points: Untrusted data enters the agent context via Slack direct messages (standup collection), GitHub Pull Request titles/descriptions, and records from HubSpot, Jira, and HRIS systems.
- Boundary markers: The workflow templates do not utilize specific delimiters or instructions to the agent to treat interpolated external data as untrusted, increasing the risk of the agent following instructions embedded in that data.
- Capability inventory: The skill utilizes the
slack-mcpserver with tools includingslack_post_message,slack_create_channel, andslack_workflow_trigger(referenced in SKILL.md). - Sanitization: There is no evidence of validation, escaping, or filtering of the external data before it is interpolated into message templates or used to trigger actions.
Audit Metadata