slack-api

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill describes building Slack bots that ingest untrusted data from workspace users via the Events API and Slash commands, creating a surface for indirect prompt injection. \n
  • Ingestion points: Slack Events API and Slash commands. \n
  • Boundary markers: Not specified in the documentation. \n
  • Capability inventory: Includes Slack Web API integration and message processing capabilities. \n
  • Sanitization: No content validation or sanitization logic is provided in the overview. \n- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install official libraries and tools. \n
  • Installs slack-bolt and slack-sdk from the standard Python package registry. \n
  • Installs ngrok for local development via the Homebrew package manager.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 08:15 AM