The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface because it ingests untrusted data from Slack and has the capability to perform write operations within the workspace.
Ingestion points: The skill reads data from Slack via SLACK_SEARCH_MESSAGES, SLACK_FETCH_CONVERSATION_HISTORY, and SLACK_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATION as described in SKILL.md.
Boundary markers: The instructions do not define delimiters or specific safety warnings to prevent the agent from following instructions embedded within the retrieved Slack messages.
Capability inventory: The skill can execute actions including SLACK_SEND_MESSAGE, SLACK_UPDATES_A_SLACK_MESSAGE, SLACK_SCHEDULE_MESSAGE, and SLACK_ADD_REACTION_TO_AN_ITEM (SKILL.md).
Sanitization: There are no instructions for sanitizing or escaping Slack content before it is processed or used to generate new messages.
[EXTERNAL_DOWNLOADS]: The skill requires the configuration of an external MCP server endpoint (https://rube.app/mcp) and references documentation from Composio (composio.dev). These external services provide the underlying tool schemas and execution environment for the Slack automation tasks.

slack-automation