block-kit
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface by ingesting untrusted JSON data from the user which is then interpolated into shell commands or passed to CLI tools for validation against the official Slack API.
- Ingestion points: User-provided JSON strings in the 'Modification Mode' and 'Fast Path' sections of
SKILL.md. - Boundary markers: The instructions do not define boundary markers or delimiters to separate untrusted user data from the agent's logic, nor do they provide warnings to ignore embedded instructions within the JSON.
- Capability inventory: The skill instructs the agent to use the
Bashtool to executecurlcommands and theslack:slack-cliskill to perform API calls and previews. - Sanitization: There are no instructions to sanitize or escape the user-provided JSON before it is used as a command-line argument, which could potentially lead to command injection if the payload contains shell-active characters like single quotes or backticks.
Audit Metadata