slack

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs extracting browser tokens (xoxc/xoxd) and placing them into config files or passing them as command-line arguments (e.g., add-workspace "xoxc-token" "xoxd-token"), which requires the LLM to handle and potentially output secret values verbatim, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text from Slack (messages/threads) is fetched at runtime via Slack API calls like search.messages, conversations.history, and conversations.replies, then the skill’s digest/export logic places the returned text/blocks content into the agent’s output context (e.g., run_digest() builds result["mentions"]/result["replies"] from msg_text and run_export() stores msg.get("text")).