The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process content from Slack workspaces, which are untrusted external data sources that could contain malicious instructions.
Ingestion points: Multiple commands, including slack message get, slack message list, slack search all, and slack canvas get (referenced in SKILL.md and references/commands.md), fetch external content into the agent's context.
Boundary markers: The skill instructions do not provide delimiters or explicit safety warnings to help the agent distinguish between its system prompt and retrieved Slack data.
Capability inventory: The agent can perform significant actions, such as sending messages, deleting content, inviting external users, and downloading attachments to the local filesystem.
Sanitization: There is no evidence of sanitization or filtering of the retrieved Slack content.
[DATA_EXFILTRATION]: The skill documents commands that enable the agent to access sensitive browser and system directories to retrieve authentication tokens.
Evidence: references/commands.md describes the slack auth import-chrome, slack auth import-firefox, and slack auth import-desktop commands, which access browser profile paths to extract Slack session credentials.
[COMMAND_EXECUTION]: The skill instructs the agent to build bash commands using user-provided strings and external Slack data.
Evidence: As seen in the slack message send and slack message edit examples in SKILL.md, user-supplied text is directly interpolated into bash commands, creating a potential surface for command injection if input is not properly handled by the underlying CLI tool.

slack