slack-standup-digest
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Potential for indirect prompt injection from untrusted data sources.
- Ingestion points: The skill reads messages from arbitrary Slack channels (e.g., #engineering, #frontend) using the Slack MCP as described in the Setup Workflow.
- Boundary markers: The instructions for building the digest prompt in SKILL.md (Step 3) do not specify the use of delimiters or 'ignore' instructions for the ingested Slack message content.
- Capability inventory: The skill utilizes
curlto communicate with the platform's internal automation API (OPENHANDS_HOST) to register tasks. - Sanitization: The setup workflow lacks explicit sanitization, validation, or filtering of Slack message content before it is interpolated into the prompt used for digest generation.
Audit Metadata