The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the user to add an external, unverified MCP server endpoint (https://rube.app/mcp) to their client configuration. This source is not associated with a known trusted organization or well-known service, creating a dependency on third-party infrastructure for the skill's core logic.
[REMOTE_CODE_EXECUTION]: By connecting to a remote MCP server, the agent adopts tool schemas and execution behaviors defined by the remote host. This allows the third-party server to influence agent actions and command execution within the workspace.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from external sources (Slack messages and threads) that can be controlled by third parties.
Ingestion points: Untrusted data enters the agent context through SLACK_SEARCH_MESSAGES, SLACK_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATION, and SLACK_FETCH_CONVERSATION_HISTORY (in SKILL.md).
Boundary markers: Absent. The instructions do not provide delimiters or warnings to ignore commands or instructions embedded within the retrieved Slack message content.
Capability inventory: The skill possesses broad write capabilities, including SLACK_SEND_MESSAGE, SLACK_ADD_REACTION_TO_AN_ITEM, and channel management tools, which could be abused if an injection is successful.
Sanitization: Absent. There is no mention of filtering, escaping, or validating the text content retrieved from the workspace before it is processed by the agent.

slack-automation