slack-api
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes building Slack bots that ingest untrusted data from workspace users via the Events API and Slash commands, creating a surface for indirect prompt injection. \n
- Ingestion points: Slack Events API and Slash commands. \n
- Boundary markers: Not specified in the documentation. \n
- Capability inventory: Includes Slack Web API integration and message processing capabilities. \n
- Sanitization: No content validation or sanitization logic is provided in the overview. \n- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download and install official libraries and tools. \n
- Installs
slack-boltandslack-sdkfrom the standard Python package registry. \n - Installs
ngrokfor local development via the Homebrew package manager.
Audit Metadata