ai-ecoverse/advanced-skills
Quarantined high-risk skills (browser session capture, WebSocket interception) for Slack and Microsoft Teams. Install only after reviewing the security implications.
76
96%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow uses `slack history`, `slack thread`, `slack search`, and `slack watch` to ingest Slack messages and outsider-authored posts from Slack channels.
Where we found it
app.slack.com
domain · 9 sites
The plugin uses `slack history`, `slack thread`, and `slack search` to fetch outsider-authored Slack messages via same-origin XHR to `app.slack.com` (`conversations.history`, `conversations.replies`, `search.messages` APIs), then acts on the returned message text — a classic indirect prompt-injection vector.
*.slack.com (WebSocket)
domain · 4 sites
The `slack watch` command subscribes to real-time Slack message frames delivered over `wss://*.slack.com` WebSocket connections and forwards them as lick events to the agent, ingesting outsider-authored content in real time.
SKILL.md
442
### slack watch <channel_id> [--scoop=<name>] [--thread=<ts>] [--filter=<js>] [--force]
444
Watch a channel or thread for new messages in real time. Each new message is delivered as a lick event
references/watch-architecture.md
63
Slack servers → wss://*.slack.com/ → Browser WebSocket
78
Slack's `wss://*.slack.com/` connections carry all real-time events (messages, typing indicators, etc.)
adobe-dx-support.enterprise.slack.com
domain · 3 sites
The `slack-support` command uses `playwright-cli` to scrape the server-rendered Slack Support Portal at this domain, reading outsider-authored help-request titles, comment threads, and status fields that the agent then acts on (view, reply, resolve).
SKILL.md
529
slack-support lists, views, replies to, creates and resolves help requests on Adobe's Slack Support Portal by scraping it in an open browser tab.
references/support-portal.md
6
`adobe-dx-support.enterprise.slack.com`). It scrapes the server-rendered portal
39
`adobe-dx-support.enterprise.slack.com` — no separate token, since the
- Audited
- Security analysis