The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with and process Slack messages, which are untrusted external inputs. This ingestion of external data, combined with the agent's ability to execute commands, constitutes an attack surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context through Slack messages (via slack_messages_search or direct triggers in channels/DMs) as described in the SKILL.md file.
Boundary markers: The prompt instructions do not specify any boundary markers or "ignore embedded instructions" warnings for the agent to use when interpreting external Slack content.
Capability inventory: The skill utilizes powerful capabilities across the slack_toolkit, such as slack_files_upload (which can access local file paths), slack_messages_send (network output), and channel management tools like slack_channels_users_invite.
Sanitization: There are no instructions for the agent to sanitize, escape, or validate the content of retrieved Slack messages before using them in tool calls or responding to the user.

slack