search-to-slack
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the public web via
WebSearchandWebFetchtools. - Ingestion points: Research data is gathered from arbitrary third-party websites during the automated search process.
- Boundary markers: The instructions do not include specific delimiters or warnings to the agent to ignore instructions that might be embedded within the retrieved web content.
- Capability inventory: The skill is configured to use
Bash(curl:*)for network communication and has access toWriteandEdittools for file system interaction. - Sanitization: While the skill documentation mentions escaping special characters to maintain Slack markdown integrity, there is no mention of sanitizing the content to prevent the agent from following malicious instructions (e.g., data exfiltration) hidden in the research results.
- [COMMAND_EXECUTION]: The skill generates and executes
curlcommands via theBashtool to post findings to Slack webhooks. This creates a data flow where untrusted input from a web search could potentially be used to manipulate shell command arguments or content, leading to unauthorized data transmission if the agent is misled by the search results.
Audit Metadata