The Agent Skills Directory

[SAFE]: The skill strictly validates the target URL using a regular expression to ensure it starts with the official Slack webhook prefix (https://hooks.slack.com/services/), preventing unauthorized data exfiltration to malicious domains.\n- [SAFE]: Slack webhook URLs are managed as secrets, stored in the user's config directory with owner-only (600) permissions to prevent local privilege escalation or credential exposure.\n- [SAFE]: The script uses curl with a temporary configuration file to handle the URL and binary data, which is a best practice that prevents sensitive data from appearing in the system's process table.\n- [SAFE]: Logic for JSON payload construction and validation is performed using Python's standard library, avoiding external dependencies and ensuring the payload adheres to Slack's structural requirements and block limits.

slack-webhook