Quarantined high-risk skills (browser session capture, WebSocket interception) for Slack and Microsoft Teams. Install only after reviewing the security implications.
94%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
import fs from 'node:fs';
import path from 'node:path';
import test, { is } from 'tst';
// slack finds its own files relative to where it is installed (__dirname),
// not at a literal /workspace/skills path, so the host jsh can run it from
// anywhere (ai-ecoverse/skills#491). This evaluates the shipped definitions
// with the script installed at /opt/skills/slack/scripts.
const SOURCE = fs.readFileSync(path.join(process.cwd(), 'scripts/slack.jsh'), 'utf8');
const INSTALLED = '/opt/skills/slack/scripts';
// The top-level `const` lines named, evaluated in file order with __dirname set.
function consts(names) {
const lines = SOURCE.split('\n').filter((l) =>
names.some((n) => new RegExp(`^const ${n} = `).test(l))
);
return new Function('__dirname', `${lines.join('\n')}\nreturn { ${names.join(', ')} };`)(
INSTALLED
);
}
test('the skill’s own files live under its install directory', () => {
is(consts(['SKILL_ROOT', 'LAST_POST_DIR']), {
SKILL_ROOT: '/opt/skills/slack',
LAST_POST_DIR: '/opt/skills/slack',
});
});