slack-standup-digest
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted message data from Slack to generate summaries, which creates an attack surface for indirect prompt injection.\n
- Ingestion points: Message content retrieved from source Slack channels via the Slack MCP search tool (SKILL.md Step 1 and 3).\n
- Boundary markers: The instructions do not specify the use of clear delimiters or instructions to ignore embedded commands within the Slack content.\n
- Capability inventory: The skill can read from and post to Slack channels; it can also create recurring automation tasks via the automation API.\n
- Sanitization: No explicit filtering or sanitization of the Slack message content is mentioned before it is interpolated into the digest prompt.\n- [COMMAND_EXECUTION]: The skill instructs the agent to execute a
curlcommand to register the automation with the backend service. This involves using platform-provided environment variables (OPENHANDS_HOST and OPENHANDS_AUTOMATION_API_KEY) to communicate with the vendor's infrastructure.
Audit Metadata