The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data by reading Slack channel history, which serves as a vector for indirect prompt injection.
Ingestion points: The conversations.history API call (described in SKILL.md) fetches message logs from external Slack channels into the agent's context.
Boundary markers: Absent. The skill does not specify delimiters or provide instructions to the agent to ignore or isolate instructions embedded within the message data.
Capability inventory: The skill has access to Bash (executing curl and jq), Read, and Write tools, which increases the potential impact of a successful injection.
Sanitization: No content sanitization, filtering, or escaping is applied to the message text before it is processed by the agent.
[PERSISTENCE]: The skill contains instructions that encourage users to persist authentication credentials in their local environment configuration.
Evidence: The setup section in SKILL.md suggests that users add the SLACK_TOKEN to shell profile files such as ~/.zshrc or ~/.bashrc to maintain the environment variable across sessions.

slack-ops