slack-respond
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses load-time command execution (
!command) inSKILL.mdto retrieve current Slack messages, load a persona file (soul.md), and generate formatting instructions. These shell commands execute every time the skill context is loaded by the agent. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Slack messages.
- Ingestion points: Raw message text (
MESSAGE_TEXT) from Slack is retrieved from an inbox script (slack_check.py) and passed to formatting and memory scripts. - Boundary markers: The skill uses XML tags for structured reasoning, but there are no explicit safety instructions to the agent to disregard malicious directives contained within the Slack message content itself.
- Capability inventory: The agent can execute shell commands, read/write local files (memory database), and post/delete messages on Slack.
- Sanitization: While the skill uses a formatting script (
slack_format.py), the specific sanitization logic for handling malicious prompt injection payloads within user messages is not defined in the skill instructions. - [COMMAND_EXECUTION]: The skill's operation depends on executing numerous local Python scripts and shell commands. It frequently sources the user's
~/.zshrcfile to load environment variables, which exposes the local shell environment and potential API tokens to the agent's execution context.
Audit Metadata