The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external Slack messages, threads, and canvases.
Ingestion points: The agent ingests untrusted content via commands such as message get, message list, search messages, unreads, and canvas get as described in SKILL.md and references/commands/message.md.
Boundary markers: There are no instructions or delimiters provided to help the agent distinguish between its system instructions and potentially malicious instructions embedded within the Slack data it reads.
Capability inventory: The agent has extensive permissions to perform actions based on interpreted content, including message send, message edit, message delete, channel new/invite, and workflow run (references/commands/message.md, references/commands/channel.md, references/commands/workflow.md).
Sanitization: The skill converts raw Slack data to Markdown but does not implement filtering or sanitization to prevent the agent from following instructions found in the message content.
[COMMAND_EXECUTION]: The skill uses the Bash tool to interface with the agent-slack CLI, which can interact with the local host environment to manage credentials.
Credential Import: The auth import-desktop and auth import-browser commands allow the agent to access sensitive local application data and browser cookies to extract Slack authentication tokens (references/commands/auth.md).
[EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to interact with Slack's official APIs and can download file attachments.
Attachment Handling: Commands like message get and file download fetch content from Slack's servers and store them in a local cache directory (~/.cache/app.paulie.agent-slack/), which the agent can subsequently read.

agent-slack