ai-ecoverse/advanced-skills
Quarantined high-risk skills (browser session capture, WebSocket interception) for Slack and Microsoft Teams. Install only after reviewing the security implications.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow monitors and consumes outsider-authored messages from Slack channels via history, search, and real-time watch features without prior user item selection.
Where we found it
app.slack.com
domain · 10 sites
The plugin fetches channel history, searches messages, reads threads, reads the activity feed, and watches channels in real time — all via same-origin XHR to app.slack.com — consuming outsider-authored Slack messages without prior user item selection.
edgeapi.slack.com
domain · 1 site
The plugin fetches user search results from edgeapi.slack.com (the edge users cache), which returns outsider-authored user profile data that the agent acts on.
SKILL.md
417
(`edgeapi.slack.com/cache/<team>/users/search`) behind Slack's own quick switcher
files.slack.com
domain · 1 site
The plugin downloads files shared by outsiders in Slack threads/channels from files.slack.com, fetching and acting on outsider-authored binary content.
SKILL.md
373
fetches the bytes authenticated inside the Slack tab (`files.slack.com` needs the session cookie)
adobe-dx-support.enterprise.slack.com
domain · 2 sites
The plugin scrapes the server-rendered Slack Support Portal at adobe-dx-support.enterprise.slack.com using playwright-cli, consuming outsider-authored support request content (titles, comments, threads) without prior user item selection.
SKILL.md
523
(`adobe-dx-support.enterprise.slack.com`). It scrapes the server-rendered portal using `playwright-cli`
SKILL.md
556
`adobe-dx-support.enterprise.slack.com` — no separate token
wss://*.slack.com
domain · 2 sites
The real-time watch feature observes the Slack WebSocket at wss://*.slack.com and forwards every matching outsider-authored message frame to the agent scoop without prior user selection of individual items.
references/watch-architecture.md
12
Slack servers → wss://*.slack.com/ → Browser WebSocket
references/watch-architecture.md
27
Slack's `wss://*.slack.com/` connections carry all real-time events (messages, typing indicators, etc.)
- Audited
- Security analysis