The Agent Skills Directory

[CREDENTIALS_UNSAFE]: In the Heroku deployment script (references/deploy-heroku.sh), the SLACK_BOT_TOKEN and SLACK_APP_TOKEN are passed as direct command-line arguments to heroku config:set. This practice makes the secrets visible to any user or system process that can view the process table (e.g., via ps or /proc). Although documented as a known limitation, it represents an unnecessary risk of credential exposure on multi-user or compromised systems.
[COMMAND_EXECUTION]: The skill uses various command-line utilities to perform its tasks, including slack, heroku, railway, git, and chmod. It also executes customized shell scripts (.slack/deploy-*.sh) that serve as deployment hooks.
[DYNAMIC_EXECUTION]: To support external hosting, the skill copies script templates from its internal references/ directory to the user's project, makes them executable, and configures the Slack CLI to run them dynamically. This results in the execution of locally-stored scripts that are assembled during the skill's setup phase.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files such as manifest.json and .slack/apps.json to identify application and team IDs. This data is used as arguments in shell commands executed by the agent.
Ingestion points: Reads metadata from manifest.json and .slack/apps.json.
Boundary markers: There are no explicit markers or warnings used to separate external data from system instructions.
Capability inventory: The skill can execute shell scripts and interact with cloud provider CLIs.
Sanitization: Variables in scripts are double-quoted to mitigate basic command injection, but the skill lacks validation for the integrity of the source JSON files.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the Heroku and Railway CLIs via official package managers. These tools are provided by well-known technology services and are documented neutrally.

deploy-slack-app