Agent Slackbot

Interact with Slack workspaces using bot tokens - send messages, read channels, manage reactions

Security Scan

The skill's files, install spec, and runtime instructions are consistent with a CLI Slack bot integration; nothing in the bundle suggests it is trying to do something other than manage bot tokens, list/post messages, and keep a small local memory of IDs.

Purpose & Capability

Name/description, included docs, example scripts, and the install spec (npm package that provides the agent-slackbot binary) all align: the package is a Slack bot CLI and the templates show expected Slack actions (list/send/update messages, manage reactions). Required binaries and files match the described purpose.

Instruction Scope

SKILL.md instructs the agent to read/write a persistent memory file (~/.config/agent-messenger/MEMORY.md) at the start and end of tasks to store workspace/channel/user IDs and aliases. That behavior is coherent for a Slack integration, but it does grant the skill persistent local state and instructs the agent to always read that file at task start — users should be aware of that persistence and the developer's guidance to never store tokens or full message contents.

Install Mechanism

Install uses an npm package (agent-messenger) which creates the agent-slackbot binary. npm installs are normal for CLI tools but carry typical third-party package risk (verify package source, maintainer, and versions). No suspicious remote URLs or extract-from-arbitrary-host installs are present.

Credentials

The skill does not require any environment variables to be set by default, but docs mention optional CI env vars (E2E_SLACKBOT_TOKEN, workspace ID/name). Authentication is handled via the CLI and credentials are saved to ~/.config/agent-messenger/slackbot-credentials.json in plaintext (docs explicitly state this). Plaintext token storage and environment-variable precedence are expected for such a CLI, but they are sensitive — use least-privilege bot tokens and secure the credential file.

Persistence & Privilege

always is false and there are no unusual privileges requested. The skill maintains its own memory file and a credential file under ~/.config/agent-messenger; it does not request system-wide or other-skills' configuration changes.

Assessment

This skill appears to do what it claims (a Slack bot CLI). Before installing: 1) Verify the npm package (agent-messenger) source, publisher, and release page or repository to ensure you trust the maintainer. 2) Use a dedicated, least-privilege Slack bot token (grant only needed scopes) in case it is compromised. 3) Be aware credentials are stored in plaintext at ~/.config/agent-messenger/slackbot-credentials.json — protect that file with filesystem permissions and consider rotating tokens periodically. 4) The skill keeps a persistent MEMORY.md (~/.config/agent-messenger/MEMORY.md) of IDs/aliases; review its contents if you care about local data retention and ensure the agent does not write sensitive message content or tokens to it. 5) If you require higher assurance, inspect the published package source code (or request the package homepage/repo) before installing.

A TypeScript CLI tool that enables AI agents and humans to interact with Slack workspaces using bot tokens (xoxb-). Unlike agent-slack which extracts user tokens from the desktop app, agent-slackbot uses standard Slack Bot tokens for server-side and CI/CD integrations.

Quick Start

# Set your bot token
agent-slackbot auth set xoxb-your-bot-token

# Or set with a custom bot identifier for multi-bot setups
agent-slackbot auth set xoxb-your-bot-token --bot deploy --name "Deploy Bot"

# Verify authentication
agent-slackbot auth status

# Send a message
agent-slackbot message send C0ACZKTDDC0 "Hello from bot!"

# List channels
agent-slackbot channel list

Authentication

Bot Token Setup

agent-slackbot uses Slack Bot tokens (xoxb-) which you get from the Slack App configuration:

# Set bot token (validates against Slack API before saving)
agent-slackbot auth set xoxb-your-bot-token

# Set with a custom bot identifier
agent-slackbot auth set xoxb-your-bot-token --bot deploy --name "Deploy Bot"

# Check auth status
agent-slackbot auth status

# Clear stored credentials
agent-slackbot auth clear

Multi-Bot Management

Store multiple bot tokens and switch between them:

# Add multiple bots
agent-slackbot auth set xoxb-deploy-token --bot deploy --name "Deploy Bot"
agent-slackbot auth set xoxb-alert-token --bot alert --name "Alert Bot"

# List all stored bots
agent-slackbot auth list

# Switch active bot
agent-slackbot auth use deploy

# Use a specific bot for one command (without switching)
agent-slackbot message send C0ACZKTDDC0 "Alert!" --bot alert

# Remove a stored bot
agent-slackbot auth remove deploy

# Disambiguate bots with same ID across workspaces
agent-slackbot auth use T123456/deploy

The --bot <id> flag is available on all commands to override the active bot for a single invocation.

Getting a Bot Token

1. Go to api.slack.com/apps
2. Create New App (or select existing)
3. Go to OAuth & Permissions
4. Add required bot token scopes (see below)
5. Install app to workspace
6. Copy the Bot User OAuth Token (starts with xoxb-)

Required Bot Token Scopes

Scope	Used For
chat:write	Sending messages
channels:history	Reading public channel messages
channels:read	Listing public channels
channels:join	Joining public channels
groups:history	Reading private channel messages
groups:read	Listing private channels
users:read	Listing users
users:read.email	Reading user email addresses
reactions:write	Adding/removing reactions
reactions:read	Listing reactions

Environment Variables (CI/CD)

For CI/CD pipelines, set these environment variables instead of using auth set:

export E2E_SLACKBOT_TOKEN=xoxb-your-bot-token
export E2E_SLACKBOT_WORKSPACE_ID=T123456
export E2E_SLACKBOT_WORKSPACE_NAME="My Workspace"

Memory

The agent maintains a ~/.config/agent-messenger/MEMORY.md file as persistent memory across sessions. This is agent-managed — the CLI does not read or write this file. Use the Read and Write tools to manage your memory file.

Reading Memory

At the start of every task, read ~/.config/agent-messenger/MEMORY.md using the Read tool to load any previously discovered workspace IDs, channel IDs, user IDs, and preferences.

• If the file doesn't exist yet, that's fine — proceed without it and create it when you first have useful information to store.
• If the file can't be read (permissions, missing directory), proceed without memory — don't error out.

Writing Memory

After discovering useful information, update ~/.config/agent-messenger/MEMORY.md using the Write tool. Write triggers include:

• After discovering workspace IDs (from auth status)
• After discovering useful channel IDs and names (from channel list, etc.)
• After discovering user IDs and names (from user list, etc.)
• After the user gives you an alias or preference ("call this the alerts bot", "my main workspace is X")
• After setting up bot identifiers (from auth list)

When writing, include the complete file content — the Write tool overwrites the entire file.

What to Store

• Workspace IDs with names
• Channel IDs with names and purpose
• User IDs with display names
• Bot identifiers and their purposes
• User-given aliases ("alerts bot", "deploys channel")
• Any user preference expressed during interaction

What NOT to Store

Never store bot tokens, credentials, or any sensitive data. Never store full message content (just IDs and channel context). Never store file upload contents.

Handling Stale Data

If a memorized ID returns an error (channel not found, user not found), remove it from MEMORY.md. Don't blindly trust memorized data — verify when something seems off. Prefer re-listing over using a memorized ID that might be stale.

Format / Example

# Agent Messenger Memory

## Slack Workspaces (Bot)

- `T0ABC1234` — Acme Corp

## Bots (Acme Corp)

- `deploy` — Deploy Bot (active)
- `alert` — Alert Bot

## Channels (Acme Corp)

- `C012ABC` — #general (company-wide announcements)
- `C034DEF` — #engineering (team discussion)
- `C056GHI` — #deploys (CI/CD notifications)

## Users (Acme Corp)

- `U0ABC123` — Alice (engineering lead)
- `U0DEF456` — Bob (backend)

## Aliases

- "deploys" → `C056GHI` (#deploys in Acme Corp)

## Notes

- Deploy Bot is used for CI/CD notifications
- Alert Bot is used for error monitoring

Memory lets you skip repeated channel list and auth list calls. When you already know an ID from a previous session, use it directly.

Commands

Message Commands

# Send a message
agent-slackbot message send <channel> <text>
agent-slackbot message send C0ACZKTDDC0 "Hello world"

# Send a threaded reply
agent-slackbot message send C0ACZKTDDC0 "Reply" --thread <ts>

# List messages
agent-slackbot message list <channel>
agent-slackbot message list C0ACZKTDDC0 --limit 50

# Get a single message by timestamp
agent-slackbot message get <channel> <ts>

# Get thread replies (includes parent message)
agent-slackbot message replies <channel> <thread_ts>
agent-slackbot message replies C0ACZKTDDC0 1234567890.123456 --limit 50

# Update a message (bot's own messages only)
agent-slackbot message update <channel> <ts> <new-text>

# Delete a message (bot's own messages only)
agent-slackbot message delete <channel> <ts> --force

Channel Commands

# List channels the bot can see
agent-slackbot channel list
agent-slackbot channel list --limit 50

# Get channel info
agent-slackbot channel info <channel>
agent-slackbot channel info C0ACZKTDDC0

User Commands

# List users
agent-slackbot user list
agent-slackbot user list --limit 50

# Get user info
agent-slackbot user info <user-id>

Reaction Commands

# Add reaction
agent-slackbot reaction add <channel> <ts> <emoji>
agent-slackbot reaction add C0ACZKTDDC0 1234567890.123456 thumbsup

# Remove reaction
agent-slackbot reaction remove <channel> <ts> <emoji>

Output Format

JSON (Default)

All commands output JSON by default for AI consumption:

{
  "ts": "1234567890.123456",
  "channel": "C0ACZKTDDC0",
  "text": "Hello world"
}

Pretty (Human-Readable)

Use --pretty flag for formatted output:

agent-slackbot channel list --pretty

Common Patterns

See references/common-patterns.md for typical AI agent workflows.

Templates

See templates/ directory for runnable examples:

• post-message.sh - Send messages with error handling
• monitor-channel.sh - Monitor channel for new messages
• workspace-summary.sh - Generate workspace summary

Error Handling

All commands return consistent error format:

{
  "error": "No credentials. Run \"auth set\" first."
}

Common errors:

• missing_token: No credentials configured
• invalid_token_type: Token is not a bot token (must start with xoxb-)
• not_in_channel: Bot needs to join the channel first
• slack_webapi_rate_limited_error: Hit rate limit (auto-retries with backoff)

Configuration

Credentials stored in: ~/.config/agent-messenger/slackbot-credentials.json

Format:

{
  "current": {
    "workspace_id": "T123456",
    "bot_id": "deploy"
  },
  "workspaces": {
    "T123456": {
      "workspace_id": "T123456",
      "workspace_name": "My Workspace",
      "bots": {
        "deploy": {
          "bot_id": "deploy",
          "bot_name": "Deploy Bot",
          "token": "xoxb-..."
        },
        "alert": {
          "bot_id": "alert",
          "bot_name": "Alert Bot",
          "token": "xoxb-..."
        }
      }
    }
  }
}

Security: File permissions set to 0600 (owner read/write only)

Key Differences from agent-slack

Feature	agent-slack	agent-slackbot
Token type	User token (xoxc-)	Bot token (xoxb-)
Token source	Auto-extracted from desktop app	Manual from Slack App config
Message search	Yes	No (requires user token)
File operations	Yes	No
Snapshot	Yes	No
Edit/delete messages	Any message	Bot's own messages only
Workspace management	Multi-workspace	Multi-bot, multi-workspace
CI/CD friendly	Requires desktop app	Yes (just set token)

Limitations

• No real-time events / Socket Mode
• No message search (requires user token scope)
• No file upload/download
• No workspace snapshot
• Bot can only edit/delete its own messages
• Bot must be invited to private channels
• No scheduled messages
• Plain text messages only (no blocks/formatting)

Troubleshooting

agent-slackbot: command not found

agent-slackbot is NOT the npm package name. The npm package is agent-messenger.

If the package is installed globally, use agent-slackbot directly:

agent-slackbot message send general "Hello"

If the package is NOT installed, use bunx agent-messenger slackbot:

bunx agent-messenger slackbot message send general "Hello"

NEVER run bunx agent-slackbot — it will fail or install a wrong package since agent-slackbot is not the npm package name.

References

• Authentication Guide
• Common Patterns