Slack Backup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:44 AM UTC
• Version: 1.0.0

Overview

This Slack backup skill has a clear purpose, but its executable behavior depends on unaudited shared files outside the reviewed artifact.

Review this skill before installing. It performs the expected Slack backup action, but only install it if the referenced shared Slack helper files are trusted, versioned with the skill, and protected from modification. Use explicit Slack wording when invoking it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: slack_backup.sh:14

Finding

Execution of Unaudited Dependencies Outside the Skill Package

Content

View full analysis

Vulnerability Details

File Location: slack_backup.sh, lines 14–23
Vulnerability Type: External shell and Python dependencies executed without integrity validation
Risk Level: Medium

Vulnerable Code

bash

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
DOWNLOADER="$SCRIPT_DIR/../shared/slack_downloader.py"
BACKUP_DIR="${BACKUP_DIR:-$HOME/.openclaw/doc/backup}"

mkdir -p "$BACKUP_DIR"

source "$SCRIPT_DIR/../shared/slack_args.sh"

python3 "$DOWNLOADER" "${SLACK_ARGS[@]}" "$BACKUP_DIR"

Technical Analysis

The script loads ../shared/slack_args.sh with source and runs ../shared/slack_downloader.py through Python. Both dependencies reside outside the audited Skill directory and were absent from the supplied project.

Sourcing a shell file executes all of its commands in the current shell process. Running the Python downloader similarly permits arbitrary code execution with the privileges of the account invoking the Skill. The script does not validate that these paths remain within a trusted package, reject symbolic links, verify file ownership or permissions, or check cryptographic hashes.

Consequently, the reviewed script does not provide a self-contained, immutable implementation of its declared behavior. Its effective behavior depends on unaudited sibling files that may be changed independently after this Skill has been reviewed.

Attack Path

1. An attacker obtains the ability to create or modify ../shared/slack_args.sh or ../shared/slack_downloader.py relative to the Skill directory. This could occur through a compromised shared component, insecure deployment process, writable parent directory, or dependency replacement.
2. The attacker inserts arbitrary shell or Python commands into the affected dependency.
3. A user invokes slack_backup.sh for a legitimate Slack backup operation.
4. The script sources the malicious shell file or e ...[truncated 1008 chars]

Remediation

View remediation

Remediation Suggestions

1. Package slack_args.sh and slack_downloader.py inside the Skill directory so that all executable components are reviewed and deployed as one versioned unit.
2. Resolve dependency paths canonically and verify that they remain beneath a trusted, read-only Skill root before loading them.
3. Reject symbolic links and validate that dependency files have trusted ownership and are not writable by untrusted users.
4. Pin approved dependency versions and verify cryptographic hashes or signed manifests before execution.
5. Avoid sourcing external shell code. Implement argument construction directly in the main script or use a non-executable configuration format with strict schema and value validation.
6. Audit the missing downloader for credential handling, destination-path validation, filename traversal, redirect behavior, TLS verification, download-size limits, and safe file creation.
7. Run the downloader with least privilege and restrict its filesystem and network access to the Slack endpoints and backup directory required for the task.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is user-invocable and its trigger phrases are broad enough to overlap with ordinary requests like 'back up the file' or 'save the Slack file locally,' which can cause accidental activation outside a clearly scoped Slack context. Because activation leads to downloading files from Slack onto local storage, an unintended trigger could copy sensitive files to disk without the user explicitly intending to invoke this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.