setting-up-support-slack-locally
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents a surface for ingesting untrusted data through a Slack webhook integration.
- Ingestion points: Inbound Slack messages are received via the
/api/conversations/v1/slack/eventsendpoint. - Boundary markers: The documentation explicitly instructs on using and verifying Slack HMAC signing via the
X-Slack-Signatureheader to ensure request authenticity. - Capability inventory: Ingested messages are processed by background workers to generate support tickets within the local PostHog instance.
- Sanitization: The implementation uses a shared signing secret (
SUPPORT_SLACK_SIGNING_SECRET) and standard cryptographic verification (openssl dgst -sha256 -hmac) to filter unauthorized inputs.
Audit Metadata