slack-workflows
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from various untrusted external environments and user inputs, creating an attack surface where malicious instructions in the source data could influence the agent's behavior.
- Ingestion points: Data enters the context via HubSpot deal properties (
company,amount,loss_reason), GitHub pull request details (pr_title,pr_description_summary), Stripe payment alerts (customer_email), and user-submitted standup responses or expense receipts. - Boundary markers: The message templates and workflow steps lack explicit delimiters or instructions for the agent to ignore embedded commands within the external data variables.
- Capability inventory: The skill possesses capabilities to post messages (
slack_post_message), create channels (slack_create_channel), trigger secondary workflows, and interface with downstream tools like Jira, Notion, and accounting systems. - Sanitization: The provided YAML and JavaScript snippets do not include content validation, escaping, or filtering for the external data being interpolated into messages.
Audit Metadata