AI review found the external command findings are Markdown code fences, not executable backticks. The Slack reference URL, environment variable reads, modal call, and enterprise_id field are normal Slack app documentation patterns. No prompt injection, exfiltration intent, or semantic abuse was found.
AI review found the external command findings are Markdown code fences, not executable backticks. The Slack reference URL, environment variable reads, modal call, and enterprise_id field are normal Slack app documentation patterns. No prompt injection, exfiltration intent, or semantic abuse was found.
Static command execution and weak cryptography alerts are false positives from Markdown fences and words such as description. The skill is not malicious, but it includes security-sensitive Slack OAuth and token handling examples that require careful secret storage, state validation, and output escaping.
The Block Kit example interpolates incident fields into Slack mrkdwn text. If those fields come from users or external systems, Slack mentions, links, or formatting could be spoofed unless escaped or normalized.
The interpolation is visible, but the source of incident data is not shown. The concern depends on whether the application accepts untrusted incident content.
The system reconnaissance alert points to an enterprise_id lookup in OAuth installation records. This is Slack workspace metadata handling, not host or network reconnaissance.
The surrounding code queries Slack installation records by team and enterprise ID. It does not inspect the local system, network, users, processes, or environment.
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The examples read Slack bot tokens, signing secrets, client IDs, and client secrets from environment variables. This is legitimate for Slack apps, but copied production code must protect these secrets and prevent logging or accidental exposure.
The file clearly accesses Slack credentials from environment variables. The usage is expected for Slack Bolt apps, so the risk is operational rather than malicious.
The OAuth example imports file-backed installation and state stores, then uses FileOAuthStateStore. File-backed OAuth state can be unsafe for distributed or production deployments without strict filesystem controls.
The example explicitly references file-backed OAuth storage. The text also recommends database-backed production storage, which reduces confidence that this is a serious flaw.
The critical and high combination heuristics are caused by legitimate Slack examples that mention credentials, a documentation URL, and file-backed OAuth state. No evidence of obfuscation, credential exfiltration, or malicious instruction was found.
The risky elements appear in explanatory Slack app patterns and do not combine into executable exfiltration behavior. The skill file is documentation, not an installed script.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Command Execution Alerts Are Markdown False Positives
The static Ruby backtick alerts point to fenced Python examples in Markdown. No executable backtick shell command is present in the skill file.
The cited lines are Markdown code fence boundaries or starts of Python examples. There is no shell execution syntax or command runner at those locations.
The static weak cryptography detections are caused by words and identifiers such as description, desc_block, and desc_input. No weak hash or cipher algorithm is shown at the cited lines.
The cited lines contain descriptive text and field names, not calls to MD5, DES, SHA1, or another weak algorithm. The nearby encrypt and decrypt placeholders are not listed static locations.
All static analysis findings are false positives. The SKILL.md file is documentation containing educational code examples for the Slack Bolt framework. Environment variable usage follows security best practices for credential handling. No executable code with security risks was detected.