creating-letta-code-channels
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides documentation and a utility script (
scaffold-user-channel-plugin.ts) for creating channel adapters. The script includes input validation for channel identifiers to prevent path traversal and prevents shadowing first-party channel IDs. - [INDIRECT_PROMPT_INJECTION]: The skill addresses potential indirect prompt injection risks associated with processing messages from external platforms (e.g., Slack, Telegram). It provides clear security guidance, such as suppressing tool approval prompts on public channels and implementing verified-operator paths for sensitive actions, which aligns with security best practices.
- [COMMAND_EXECUTION]: The skill uses a local script for scaffolding boilerplate. The script performs safe file operations within a scoped directory (
~/.letta/channels/) and does not perform network operations or execute arbitrary remote code.
Audit Metadata