The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on the @useclawlink/cli tool, executed via npx, to interact with the Slack API. This includes commands for logging in, connecting to the workspace, and executing various Slack actions.
[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download and run the ClawLink CLI directly from the NPM registry using npx @useclawlink/cli. These resources are owned by the skill's vendor and are hosted on a well-known package registry.
[INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection because it allows the agent to ingest arbitrary text data from external Slack conversations.
Ingestion points: Actions like slack_fetch_conversation_history, slack_fetch_message_thread_from_a_conversation, and slack_search_messages retrieve content from an attacker-controllable source (Slack messages).
Boundary markers: The instructions include a manual safety check, stating the agent should "confirm with the user before any write."
Capability inventory: The skill possesses impactful capabilities, including sending messages (slack_send_message), deleting files (slack_delete_file), and managing user invites/removals, which could be targeted by injected instructions.
Sanitization: There is no evidence of programmatic sanitization or filtering of the Slack content before it is processed by the agent.

slack