cyrus-setup-slack
Pass
Audited by Gen Agent Trust Hub on Mar 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes bash commands such as
grep,printf, andcutto interact with the local configuration file~/.cyrus/.env. These commands are used to check for existing configurations and append placeholders for Slack credentials without exposing the values to the model. - [SAFE]: The skill includes robust defensive instructions that prevent the agent from reading, scraping, or extracting secret tokens into its memory or conversation history. It implements a secure credential collection process where the user manually pastes sensitive information into a local file opened by a native system editor (e.g., VS Code or TextEdit), ensuring secrets remain under the user's control.
- [REMOTE_CODE_EXECUTION]: Utilizes browser automation tools (
claude-in-chromeandagent-browser) to facilitate the app creation process on api.slack.com. This includes a JavaScriptevalcall to programmatically populate the manifest JSON into the Slack developer portal, which is consistent with the skill's stated purpose of automating setup.
Audit Metadata