The Agent Skills Directory

[COMMAND_EXECUTION]: The skill's core functionality relies on executing a local binary named slack-cli. It invokes multiple subcommands such as auth, cache, channels, conversations, and users to perform tasks. While expected for a CLI-based skill, this grants the agent the ability to execute commands on the host system.
[EXTERNAL_DOWNLOADS]: The documentation instructs the user to install the required binary using brew install paymog/tap/slack-cli. This involves downloading and executing code from an external Homebrew tap and GitHub repository (github.com/paymog/slack-cli). As 'paymog' is the stated author of the skill, these are considered vendor-provided resources.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection by design. It reads and processes untrusted data from external Slack environments.
Ingestion points: Tools like slack-cli conversations history, slack-cli conversations search, slack-cli conversations unreads, and slack-cli users search fetch messages, thread replies, and user profiles directly into the agent's context.
Boundary markers: The skill description does not specify the use of delimiters or instructions to the agent to ignore embedded commands within the Slack data it retrieves.
Capability inventory: The skill can post messages (conversations add), add reactions, download files to the local disk (attachments get -o path), and read sensitive authentication tokens.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from Slack before it is presented to the agent.
[CREDENTIALS_UNSAFE]: The skill requires the use of sensitive Slack authentication tokens (OAuth xoxp/xoxb or browser session xoxc/xoxd). It encourages setting these as environment variables (SLACK_MCP_XOXP_TOKEN, etc.) or storing them in local profiles (slack-cli auth login), which involves handling high-value credentials that could be targeted by other malicious processes or skills.

slack-cli