slack-voice
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Slack messages and threads to sample writing styles, creating a surface for indirect prompt injection attacks.
- Ingestion points: The skill explicitly instructions the agent to "sample their live messages in the same thread or DM" and process "incoming messages" provided by the user.
- Boundary markers: There are no instructions to use delimiters or ignore potentially malicious instructions embedded within the sampled Slack messages.
- Capability inventory: The agent has the ability to read from and write to Slack, including creating drafts and sending messages.
- Sanitization: The skill does not define any sanitization or filtering logic for the content it reads from Slack threads.
- [DYNAMIC_EXECUTION]: The skill utilizes a self-modification pattern where the agent is instructed to update its own instruction set based on runtime interactions.
- Self-modifying logic: The "Learn from rewrites" section instructs the agent to "Add the lesson to this skill as a concrete before and after" and "save a short memory fact." This directs the AI to modify its own source instructions (SKILL.md) at runtime, which is a form of dynamic context modification.
Audit Metadata