block-kit
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed to assist developers in creating Slack UI components. It follows best practices by fetching documentation from official Slack domains (docs.slack.dev) and validating generated payloads using Slack's public validation API (slack.com/api/blocks.validate).
- [COMMAND_EXECUTION]: The skill uses standard shell commands via the Bash tool to call the official Slack validation API. These calls are restricted to the vendor's own infrastructure and do not involve sensitive credential handling or exfiltration patterns.
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation markdown files from official Slack developer documentation. These references are used for informational purposes to ensure the generated UI components match current schemas.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions and existing JSON to generate or modify Slack Block Kit layouts. While this represents a data ingestion surface, the skill's primary function is to produce structured UI data, and it includes a mandatory validation step against official Slack APIs to ensure the integrity and validity of the output.
Audit Metadata