The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted message content and search results from Slack, which could contain malicious instructions designed to manipulate the agent's behavior.
Ingestion points: scripts/slack.py retrieves external data via search.messages, conversations.history, and conversations.replies methods.
Boundary markers: The instructions in SKILL.md advise the agent to resolve mentions before quoting and to wait for user confirmation for writes, but there are no technical delimiters used to isolate Slack content from the agent's instructions.
Capability inventory: The skill can execute any Slack Web API method, including state-changing operations like chat.postMessage, chat.update, or conversations.join.
Sanitization: The slack.py script passes arguments directly to the API and returns the raw JSON response to the agent without filtering or sanitizing the content for embedded instructions.
[COMMAND_EXECUTION]: The skill requires the agent to execute a local Python script (scripts/slack.py) to perform its primary functions. While the script uses only standard libraries, the agent is instructed to run it via the command line, sometimes using interactive shell modes (zsh -ic) to load environment variables.
[DATA_EXFILTRATION]: The skill handles a highly sensitive session cookie (SLACK_D_COOKIE) which provides full access to the user's Slack account. This cookie is transmitted over the network to the URL specified in SLACK_URL. While intended for use with Slack's official workspace domains, the script does not validate the destination domain, meaning the cookie could be sent to an arbitrary endpoint if the SLACK_URL environment variable is misconfigured or manipulated.

use-slack