slack-channel-monitor
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Diagnostic shell commands in
SKILL.mdandreferences/windows.mdutilizecurlpiped topython3 -corpython -c. These are used locally to parse JSON data from the Slack API for token verification and do not execute remote payloads. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted message data from Slack channels to provide context. It implements a mandatory evidence chain for safety: 1. Ingestion points: Slack API responses in
scripts/main.py. 2. Boundary markers: Explicit delimiters (--- Background context ---) are present in the prompt template. 3. Capability inventory: The agent has access toterminalandfile_editortools. 4. Sanitization: The skill provides clear instructions to the agent to treat context as informational and ignore embedded instructions. - [DATA_EXFILTRATION]: Slack API tokens are handled using the platform's secure secret management system. The skill communicates exclusively with official Slack endpoints and the configured OpenHands backend.
- [COMMAND_EXECUTION]: The setup workflow involves executing local shell commands for configuration tasks such as resolving Slack channel IDs and validating script syntax, which are necessary for the skill's operation.
- [DYNAMIC_EXECUTION]: The skill configures the automation by performing static string substitutions on the
scripts/main.pytemplate. This is a low-risk, controlled generation of a deployment script.
Audit Metadata