slack
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Slack messages which could contain malicious instructions designed to influence the agent's behavior. 1. Ingestion points: Message history, thread replies, and search results are retrieved from the Slack API in scripts/slack_client.py. 2. Boundary markers: The skill does not employ specific delimiters or instructions to prevent the agent from following commands embedded in message text. 3. Capability inventory: The skill has capabilities to post messages (send), download files from Slack (download), and write archives to the local filesystem (export). 4. Sanitization: The clean_text method in scripts/slack_client.py handles Slack-specific markup but does not filter for natural language instructions.
- [DYNAMIC_EXECUTION]: The skill uses a background process to synchronize its local user cache. Evidence: The trigger_background_user_refresh function in scripts/slack_client.py uses subprocess.Popen to execute a detached instance of the client script for fetching user data. The command is constructed using a fixed argument list and the system's python executable, which minimizes command injection risks.
Audit Metadata