The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill utilizes dynamic import() to load Slack channel adapter logic from a computed path (../../channels/slack.js) in src/modules/slack-agent-flow/slack-deps.ts. This is employed to manage optional skill dependencies at runtime.
[COMMAND_EXECUTION]: The scripts/slack-agent-flow-finish.ts file uses execFileSync to execute a local shell script (setup/lib/restart.sh) for the purpose of restarting the agent service.
[DATA_EXFILTRATION]: The first 300 characters of a new agent's instructions (system prompt) are transmitted to a remote broker at slack.nanoclaw.dev via src/modules/slack-agent-flow/provision.ts. While the target domain is a vendor-owned resource for the NanoClaw platform, it constitutes the transmission of potentially sensitive prompt content to an external service.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Slack and interpolates it into system-generated messages and nudges without strict boundary markers, creating a potential surface for indirect prompt injection.
Ingestion points: Slack event data (messages and membership events) received through provisioned bot adapters, as handled in src/modules/slack-agent-flow/orchestrate.ts.
Boundary markers: The skill lacks explicit delimiters or instructions for the agent to ignore embedded commands when interpolating data like room names or purposes in roomIntroNudgeText within src/modules/slack-agent-flow/orchestrate.ts.
Capability inventory: The skill possesses the ability to perform subprocess calls (scripts/slack-agent-flow-finish.ts), write to the .env file (src/modules/slack-agent-flow/env-file.ts), and perform network operations to a remote provisioning broker (src/modules/slack-agent-flow/provision.ts).
Sanitization: The skill performs basic slugging via normalizeName but does not implement comprehensive sanitization or filtering of external content before interpolation.

slack-agent-flow