synthesis-slack-sync
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python utility scripts provided in its package (scripts/preflight.py, thread_checker.py, and retrofit_permalinks.py) to handle synchronization tasks such as ID resolution and markdown formatting. The sync protocol also involves calling scripts from related internal skills (synthesis-daily-rituals). The test script scripts/test_preflight.py invokes subprocess.run to execute the preflight script for validation purposes. These executions are scoped to local utility scripts.\n- [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves processing untrusted external data from Slack via MCP tools (slack_read_channel, slack_read_thread). This content is written to local markdown files and used to update a daily action plan, creating a potential surface for injection through malicious messages.\n
- Ingestion points: Slack channel and thread messages retrieved through MCP tool calls.\n
- Boundary markers: The protocol uses sync headers (## Mid-day sync) and horizontal rules to delimit sessions, but does not implement dedicated delimiters for the content of individual messages to isolate them from instructions.\n
- Capability inventory: The skill has the ability to read and write to the local file system (transcripts and daily plans) and execute included Python scripts via the shell.\n
- Sanitization: Incoming Slack message content is written verbatim into the transcript files without filtering or escaping of markdown structural elements.
Audit Metadata