The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Slack which could contain malicious instructions designed to influence the AI agent's behavior.
Ingestion points: Data enters the agent context through tools like messages.read, channels.read, and search.read defined in manifest.yaml.
Boundary markers: The skill instructions do not explicitly specify the use of delimiters (like XML tags or markdown blocks) to isolate content from Slack from the agent's instructions.
Capability inventory: The skill has the ability to perform mutations via the write actions in manifest.yaml, including messages.send, messages.schedule, and canvases.update through the slack call-tool command.
Sanitization: There is no evidence of specific sanitization or filtering logic applied to Slack content before it is processed by the agent.

slack