ClawHub
Back to skill

Security audit

slack

Security checks across malware telemetry and agentic risk

Overview

This Slack skill is a disclosed Slack API helper that can read channel data and post or change reactions in Slack, with no hidden persistence or unrelated behavior found.

Install only if you want the agent to use your connected Slack bot to read visible channel history and perform explicit Slack writes. Be careful with broad Slack requests, private channels, message history without limits, and any request that posts messages or changes reactions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill relies on auto-injected Slack credentials and networked API access, but the manifest does not declare those capabilities or permissions. Undeclared access reduces transparency and weakens policy enforcement, making it easier for a caller or reviewer to underestimate that the skill can read workspace data and perform external actions.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger language says to use the skill for any 'Slack-related operation,' which is overly broad and can cause unnecessary activation for ambiguous requests. In context, this skill has read and write access to an external Slack workspace, so broad routing increases the chance of unintended data access or unintended message/reaction changes.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The description advertises posting messages and changing reactions but does not clearly warn that these are state-changing operations in a real external Slack workspace. Without explicit disclosure, users or downstream agents may treat the skill as informational and trigger actions that modify customer data, communications, or workflow signals.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.