slack-cli

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to capture and display a single-use login ticket (shown verbatim in a slash command) and to pass that ticket as a command-line argument, which requires the LLM to handle and output secret token values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). The curl | bash install URL (https://downloads.slack-edge.com/slack-cli/install.sh) is a direct remote shell script execution — a high-risk delivery pattern that can distribute malware if the host or CDN is compromised, while the docs link is benign.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Exclusion: SKILL.md describes a local Slack CLI workflow (help/doc search via slack docs search and Web API calls via slack api), but it does not state that the required runtime workflow ingests outsider-authored free text without first selecting trusted, specific items; outsider text would only become readable if explicitly provided/queried (e.g., a user-provided docs search query), which is not a “monitored feed/queue” ingestion path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs the user at runtime to run curl -fsSL https://downloads.slack-edge.com/slack-cli/install.sh | bash, which fetches and immediately executes remote code as part of installation and is treated as a required dependency.