slack-notify

SUSPICIOUS: The skill's purpose is coherent and its Slack credential scope is proportionate, but it routes live Slack tokens through an unverified third-party CLI (`slack-post`) rather than Slack's official API/CLI path. The markdown command-injection findings are benign documentation artifacts, yet install/execution trust and credential forwarding keep this at medium risk.