slack-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly instructs the agent to call SLACK_SEARCH_MESSAGES, SLACK_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATION, and SLACK_FETCH_CONVERSATION_HISTORY (e.g., in "Search Messages and Conversations" and "React to and Thread Messages") to read workspace messages—which are user-generated/untrusted content—and then act on them (add reactions, send replies), so third-party content can directly influence tool use and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires adding and using https://rube.app/mcp as the MCP server and instructs calling RUBE_SEARCH_TOOLS at runtime to fetch current tool schemas, which directly define and control the agent's available tools/instructions, so the external URL can control agent prompts/behavior.