slack-channel-monitor
Fail
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: HIGHPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from Slack messages. \n
- Ingestion points: Message content is retrieved from Slack channels in scripts/main.py using search and history API calls. \n
- Boundary markers: The script uses clear delimiter lines and an explicit warning in the initial_prompt to instruct the agent to distinguish between the triggering user request and background channel context. \n
- Capability inventory: The automation script can read Slack history, post messages to Slack, and create/manage OpenHands conversations. \n
- Sanitization: External message content is interpolated directly into prompts; security relies on the agent's adherence to the provided boundary markers. \n- [COMMAND_EXECUTION]: The setup workflow involves shell commands to verify Slack tokens and resolve channel names. These commands interact with official Slack API endpoints and perform local file management to package the automation script. \n- [REMOTE_CODE_EXECUTION]: Automated scans flagged a pattern where Slack API responses are piped to a Python interpreter. Analysis confirms this is a benign verification step targeting a well-known service (slack.com), where the Python logic being executed is a local inline command used to process JSON data.
Recommendations
- HIGH: Downloads and executes remote code from: https://slack.com/api/auth.test - DO NOT USE without thorough review
Audit Metadata