The Agent Skills Directory

[DATA_EXFILTRATION]: The skill facilitates the extraction of sensitive authentication material from the local host environment.
Evidence: The auth import-desktop and auth import-browser commands (documented in references/commands/auth.md) access local application data directories and browser profiles for Chrome, Brave, Firefox, Safari, and Opera to extract Slack session tokens (xoxc, xoxd).
[COMMAND_EXECUTION]: The skill includes a raw escape hatch for executing arbitrary Slack API methods.
Evidence: The api call <method> command (documented in references/commands/other.md) allows the agent to POST any Slack Web API method directly, which can bypass the constraints and logic implemented in the standard command set.
[PRIVILEGE_ESCALATION]: Certain authentication features require elevated system-level permissions.
Evidence: The auth import-browser safari command (referenced in references/commands/auth.md) explicitly notes that it requires "Full Disk Access" permissions on macOS to access the Safari cookie store.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external source (Slack) which may contain malicious instructions targeting the agent.
Ingestion points: The agent reads external content via message get, message list, search messages, and unreads (SKILL.md).
Boundary markers: The skill does not implement explicit boundary markers or instruction-ignoring delimiters for the retrieved content.
Capability inventory: The agent has the ability to send messages, delete content, invite users, run workflows, and write/read files within the local cache directory.
Sanitization: Content is rendered as a Markdown string by merging raw Slack text and blocks (references/formatting.md).

agent-slack