open-tag-admin
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection.
- Ingestion points: In
scripts/slack_socket_agent.py, the skill retrieves the full Slack thread history using theconversations.repliesAPI method. - Boundary markers: The retrieved thread content is interpolated into a system prompt in
scripts/opentag_agent.pyinside a block labeled 'Slack thread context', but without strong structural delimiters or instructions to ignore embedded commands. - Capability inventory: The skill can invoke high-autonomy agents (
claudeorcodex) that have file system access and shell execution capabilities. - Sanitization: There is no sanitization or escaping of the user-provided thread content before it is passed to the AI backend.
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto execute CLI agents. - In
scripts/opentag_agent.py, the backends are invoked with flags that explicitly bypass security constraints, such as--dangerously-skip-permissions(for Claude) and--dangerously-bypass-approvals-and-sandbox(for Codex). - This grants the agent full autonomy over the host workspace and inherited environment based on input derived from untrusted Slack messages.
Audit Metadata