The Agent Skills Directory

[COMMAND_EXECUTION]: The slack_bridge.py script executes the claude command-line interface using subprocess.run to process incoming messages.
Evidence: The script uses the --dangerously-skip-permissions flag, which explicitly instructs the underlying agent to bypass manual confirmation for high-risk operations (like file modification or shell execution).
Evidence: Commands are constructed using data received directly from Slack users, creating a path for remote system control if the user whitelist is misconfigured or a Slack account is compromised.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its Slack listener component.
Evidence Chain:
Ingestion points: slack_bridge.py ingests untrusted text from Slack DMs and channel mentions via the handle_message function.
Boundary markers: None. The Slack message content is directly appended to a system-level prompt inside the run_claude_code function.
Capability inventory: The system prompt explicitly informs the processing agent that it has 'full access to this workspace including Obsidian vault, skills, and tools' and 'can read files, send emails, etc.'
Sanitization: There is no input sanitization or escaping performed on the Slack message text. The only guardrail is a hardcoded ALLOWED_USERS whitelist in slack_bridge.py.
[EXTERNAL_DOWNLOADS]: slack_skill.py contains a download command that fetches files from Slack's servers and writes them to the local file system.
Evidence: The cmd_download function uses urllib.request with the user's bot token to save remote files to /tmp or a user-specified path.

slack-skill