Agent Slack

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:06 AM UTC
• Version: 1.10.5

Overview

This Slack skill should be reviewed carefully because it automatically extracts and stores Slack session credentials and contains unsafe, contradictory install guidance.

Install only after confirming you are comfortable with user-equivalent Slack access, automatic desktop-session credential extraction, plaintext local token storage, and broad workspace snapshots. Do not follow the template instructions to install the agent-slack package; use the intended agent-messenger package only, and avoid running snapshot/export templates from repositories, shared folders, CI workspaces, or synced directories.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/authentication.md:19
• Finding: Automatic Extraction and Plaintext Storage of All Slack Workspace Session Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-40`; `references/authentication.md:19-27, 145-150` **Vulnerability Type**: Excessive credential access and insecure credential storage **Risk Level**: High ### Vulnerable Code From `SKILL.md:24-40`: ```markdown # Get workspace snapshot (credentials are extracted automatically) agent-slack snapshot # Send a message agent-slack message send general "Hello from AI agent!" # List channels agent-slack channel list ``` ```markdown Credentials are extracted automatically from the Slack desktop app on first use. No manual setup required — just run any command and authentication happens silently in the background. On macOS, the system may prompt for your Keychain password the first time (required to decrypt Slack's stored token). This is a one-time prompt. **IMPORTANT**: NEVER guide the user to open a web browser, use DevTools, or manually copy tokens from a browser. Always use `agent-slack auth extract` to obtain tokens from the desktop app. ``` From `references/authentication.md:19-27`: ```markdown This command: 1. Detects your operating system (macOS, Linux, Windows) 2. Locates the Slack desktop app data directory (supports both direct download and App Store versions on macOS) 3. Reads the LevelDB storage containing session data 4. Decrypts cookies using macOS Keychain (for sandboxed App Store version) 5. Validates tokens against Slack API before saving 6. Extracts xoxc token and xoxd cookie for ALL logged-in workspaces 7. Stores credentials securely in `~/.config/agent-messenger/slack-credentials.json` ``` From `references/authentication.md:145-150`: ```markdown ### Security - File permissions: `0600` (owner read/write only) - Tokens are stored in plaintext (same as Slack desktop app) - Keep this file secure - it grants full access to your Slack workspaces ``` ### Technical Analysis The documented authentication flow reads Slack desktop application storage, decrypts session cookies thro ...[truncated 2626 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace desktop-session extraction with Slack's supported OAuth authorization flow. 2. Request only the minimum OAuth scopes required for the requested operation. 3. Require explicit user consent before authenticating and clearly identify the workspace and scopes involved. 4. Authenticate only the workspace selected by the user rather than every logged-in workspace. 5. Do not extract or persist `xoxd` browser session cookies. 6. Store refresh tokens or access tokens in an operating-system credential manager such as macOS Keychain, Windows Credential Manager, or Secret Service on Linux. 7. If file-based storage is unavoidable, encrypt credentials with a key held outside the file, retain `0600` permissions, and prevent inclusion in backups and version control. 8. Add commands for credential inventory, expiration, revocation, and per-workspace deletion. 9. Ensure debug output never contains tokens, cookies, authorization headers, or credential-bearing API responses. 10. Subject the external package that performs extraction to a separate source-code and supply-chain audit. ]]>

T08 · Insecure Dependencies

Error

• Location: templates/monitor-channel.sh:134
• Finding: Templates Recommend Installing a Known Unrelated Global Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11-13, 425-432`; `templates/monitor-channel.sh:134-139`; `templates/post-message.sh:101-106`; `templates/workspace-summary.sh:30-35` **Vulnerability Type**: Dependency confusion and package substitution **Risk Level**: High ### Vulnerable Code The declared package in `SKILL.md:11-13` is: ```yaml - kind: node package: agent-messenger bins: [agent-slack] ``` The warning in `SKILL.md:425-432` states: ```markdown If the package is NOT installed, use `bunx agent-messenger slack` (note: `slack` subcommand, not `agent-slack`): ```bash bunx agent-messenger slack message list general ``` **NEVER run `bunx agent-slack`** — a separate, unrelated npm package named `agent-slack` exists on npm. It will silently install the **wrong package** with different (fewer) commands. ``` However, `templates/monitor-channel.sh:134-139` recommends: ```bash if ! command -v agent-slack &> /dev/null; then echo -e "${RED}Error: agent-slack not found${NC}" echo "" echo "Install it with:" echo " bun install -g agent-slack" exit 1 fi ``` The same conflicting recommendation appears in `templates/post-message.sh:101-106`: ```bash if ! command -v agent-slack &> /dev/null; then echo -e "${RED}Error: agent-slack not found${NC}" echo "" echo "Install it with:" echo " bun install -g agent-slack" exit 1 fi ``` It also appears in `templates/workspace-summary.sh:30-35`: ```bash if ! command -v agent-slack &> /dev/null; then echo -e "${RED}Error: agent-slack not found${NC}" >&2 echo "" >&2 echo "Install it with:" >&2 echo " npm install -g agent-slack" >&2 exit 1 fi ``` ### Technical Analysis The project declares `agent-messenger` as the intended npm package and explicitly warns that `agent-slack` is a separate, unrelated package. Despite that warning, all three runnable templates instruct users to install `agent-slack` globally when the expected executable is absent. This creates a direct pa ...[truncated 2171 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace every `npm install -g agent-slack` and `bun install -g agent-slack` instruction with the correct package name, `agent-messenger`. 2. Pin installation instructions to a reviewed version, for example: ```bash npm install -g agent-messenger@1.10.5 ``` 3. Prefer a lockfile-backed local dependency or a pinned invocation rather than an unpinned global installation. 4. If using Bun without global installation, use the documented command form: ```bash bunx agent-messenger@1.10.5 slack ``` 5. Verify the installed executable's provenance and version before use. 6. Add an automated test that scans documentation and templates for forbidden package names. 7. Publish checksums, provenance attestations, or signed release information for the intended package. 8. Remove any previously installed unrelated `agent-slack` package and rotate Slack credentials if that package was executed with access to them. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:63
• Finding: Untrusted Slack Metadata Can Be Persisted into Cross-Session Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:63-80, 95-99` **Vulnerability Type**: Persistent agent-state poisoning **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:63-80`: ```markdown ## Memory The agent maintains a `~/.config/agent-messenger/MEMORY.md` file as persistent memory across sessions. This is agent-managed — the CLI does not read or write this file. Use the `Read` and `Write` tools to manage your memory file. ### Reading Memory At the **start of every task**, read `~/.config/agent-messenger/MEMORY.md` using the `Read` tool to load any previously discovered workspace IDs, channel IDs, user IDs, and preferences. - If the file doesn't exist yet, that's fine — proceed without it and create it when you first have useful information to store. - If the file can't be read (permissions, missing directory), proceed without memory — don't error out. ### Writing Memory After discovering useful information, update `~/.config/agent-messenger/MEMORY.md` using the `Write` tool. Write triggers include: - After discovering workspace IDs (from `workspace list`) - After discovering useful channel IDs and names (from `channel list`, `snapshot`, etc.) - After discovering user IDs and names (from `user list`, `user me`, etc.) - After the user gives you an alias or preference ("call this the deploys channel", "my main workspace is X") ``` From `SKILL.md:95-99`: ```markdown Never store tokens, cookies, credentials, or any sensitive data. Never store full message content (just IDs and channel context). Never store file upload contents. ### Handling Stale Data If a memorized ID returns an error (channel not found, user not found), remove it from `MEMORY.md`. Don't blindly trust memorized data — verify when something seems off. Prefer re-listing over using a memorized ID that might be stale. ``` ### Technical Analysis The Skill requires the agent to read a shared persistent Markdown file at the beginning of every task and to overwrite ...[truncated 2291 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not require memory to be loaded at the start of every task; load it only for explicit Slack operations. 2. Isolate memory by Skill, user, and Slack workspace. 3. Store only structured records with a strict schema, such as validated Slack IDs and normalized display labels. 4. Never store executable instructions or free-form preference text. 5. Require explicit user confirmation before creating or changing aliases and workspace defaults. 6. Record the source, timestamp, workspace, and trust level for each entry. 7. Validate Slack IDs against the live API before using them for consequential actions. 8. Ask for confirmation before sending content when a target was selected from persistent memory. 9. Protect the memory file with restrictive permissions and integrity controls. 10. Treat all loaded memory as untrusted data rather than instructions. 11. Provide a command to review, expire, and delete persisted entries. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: templates/workspace-summary.sh:146
• Finding: Workspace Summary Silently Persists a Full Slack Snapshot with Default Permissions<![CDATA[ ## Vulnerability Details **File Location**: `templates/workspace-summary.sh:46-55, 65-75, 146-148` **Vulnerability Type**: Unrequested sensitive-data persistence **Risk Level**: Medium ### Vulnerable Code The script retrieves a complete workspace snapshot in `templates/workspace-summary.sh:46-55`: ```bash echo -e "${YELLOW}Fetching workspace snapshot...${NC}" >&2 SNAPSHOT=$(agent-slack snapshot 2>&1) if echo "$SNAPSHOT" | jq -e '.error' > /dev/null 2>&1; then echo -e "${RED}Failed to get snapshot${NC}" >&2 ERROR_MSG=$(echo "$SNAPSHOT" | jq -r '.error // "Unknown error"') echo -e "${RED}Error: $ERROR_MSG${NC}" >&2 exit 1 fi ``` It processes sensitive workspace data in `templates/workspace-summary.sh:65-75`: ```bash WORKSPACE_NAME=$(echo "$SNAPSHOT" | jq -r '.workspace.name // "Unknown"') WORKSPACE_ID=$(echo "$SNAPSHOT" | jq -r '.workspace.id // "Unknown"') CHANNELS=$(echo "$SNAPSHOT" | jq '.channels // []') CHANNEL_COUNT=$(echo "$CHANNELS" | jq 'length') PUBLIC_COUNT=$(echo "$CHANNELS" | jq '[.[] | select(.is_private == false)] | length') PRIVATE_COUNT=$(echo "$CHANNELS" | jq '[.[] | select(.is_private == true)] | length') USERS=$(echo "$SNAPSHOT" | jq '.users // []') USER_COUNT=$(echo "$USERS" | jq 'length') MESSAGES=$(echo "$SNAPSHOT" | jq '.recent_messages // []') ``` It then unconditionally writes the entire unfiltered snapshot in `templates/workspace-summary.sh:146-148`: ```bash SNAPSHOT_FILE="workspace-snapshot-$(date +%Y%m%d-%H%M%S).json" echo "$SNAPSHOT" > "$SNAPSHOT_FILE" echo -e "${GREEN}✓ Full snapshot saved to: $SNAPSHOT_FILE${NC}" ``` ### Technical Analysis The script is presented as a workspace-summary utility, but it always writes the complete raw Slack snapshot to the current working directory after displaying the formatted summary. This happens even when the user did not request JSON output or specify an output file. The snapshot includes workspace metadata, channels, users, and recent message content. The output f ...[truncated 1736 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not save the raw snapshot by default. 2. Add an explicit output option, such as: ```bash ./workspace-summary.sh --output /secure/path/summary.json ``` 3. Require confirmation before persisting recent messages or private-channel metadata. 4. Set a restrictive file-creation mask before writing: ```bash umask 077 ``` 5. Create files atomically and verify that the destination is not a symbolic link. 6. Save a minimized summary instead of the full API response unless raw data is explicitly requested. 7. Offer flags to exclude messages, private channels, user data, and other sensitive fields. 8. Warn users against writing snapshots into repositories, shared folders, CI workspaces, or synchronized directories. 9. Add generated snapshot filenames to `.gitignore` as a secondary safeguard. 10. Document retention and secure deletion procedures for exported snapshots. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description presents the skill as interactive Slack messaging/reading, but the documented snapshot and reporting features enable workspace-wide enumeration of channels, users, and recent messages, with machine-readable JSON output suitable for bulk collection. That expansion materially increases privacy and exfiltration risk compared with the advertised purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description presents the skill as interactive Slack messaging/reading, but the documented snapshot and reporting features enable workspace-wide enumeration of channels, users, and recent messages, with machine-readable JSON output suitable for bulk collection. That expansion materially increases privacy and exfiltration risk compared with the advertised purpose.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Automatically extracting Slack credentials from the desktop app and authenticating silently removes informed user consent at the point of credential access. This is especially dangerous because it may trigger access to stored tokens and cookies from local protected storage, enabling broad Slack access without an explicit warning or confirmation.

Credential Access

High

• Category: Privilege Escalation

Content

## Configuration

Credentials stored in: `~/.config/agent-messenger/slack-credentials.json`

Format:
```json

• Confidence: 98% confidence
• Finding: The documentation explicitly identifies a local credentials file containing Slack tokens and cookies. Exposing the path and format is not itself exploitation, but in a skill that can influence agent behavior it normalizes access to high-value secrets and increases the risk of credential theft or misuse if other tools can read local files.

Credential Access

High

• Category: Privilege Escalation

Content

Common causes:
- Slack desktop app is not installed or not logged in
- macOS Keychain access was denied (re-run and approve the prompt)
- Slack was installed via a method that uses a different storage path

### `agent-slack: command not found`

• Confidence: 96% confidence
• Finding: The Keychain-related guidance confirms the tool accesses protected local credential storage to recover Slack authentication material. In context, that is a high-sensitivity capability because compromise or misuse could grant workspace access without normal login flows.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: These steps instruct the tool to locate Slack local storage, read LevelDB session data, decrypt cookies via macOS Keychain, validate them, and save xoxc/xoxd secrets for all logged-in workspaces. This is effectively credential harvesting from another application's private session store, and successful exploitation yields persistent authenticated access to potentially multiple Slack tenants as the victim user.

Credential Access

High

• Category: Privilege Escalation

Content

4. Decrypts cookies using macOS Keychain (for sandboxed App Store version)
5. Validates tokens against Slack API before saving
6. Extracts xoxc token and xoxd cookie for ALL logged-in workspaces
7. Stores credentials securely in `~/.config/agent-messenger/slack-credentials.json`

### Platform-Specific Paths

• Confidence: 98% confidence
• Finding: This line confirms that extracted Slack session credentials are saved to a local JSON file after being harvested from the desktop client. Storing reusable xoxc/xoxd session material enables persistent compromise if the file is read, copied, backed up insecurely, or exposed through other local processes.

Credential Access

High

• Category: Privilege Escalation

Content

Credentials are stored in:
```
~/.config/agent-messenger/slack-credentials.json
```

### Format

• Confidence: 97% confidence
• Finding: The documentation advertises a fixed filesystem location for a file containing Slack session credentials. Publicly documenting the location of a high-value secrets file lowers the effort needed for malware, insider abuse, or accidental leakage to locate and exfiltrate those credentials.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The guidance tells users to grant the terminal Full Disk Access so the tool can read Slack app data, expanding host-level access far beyond normal Slack messaging needs. This permission increase weakens endpoint protections and can expose many unrelated sensitive files to the tool or anything running in that terminal context.

Credential Access

High

• Category: Privilege Escalation

Content

### Best Practices

1. **Protect credentials.json**: Never commit to version control
2. **Use workspace switching**: Don't mix personal/work contexts
3. **Re-extract periodically**: Keep tokens fresh
4. **Revoke if compromised**: Log out of Slack desktop app to invalidate tokens

• Confidence: 94% confidence
• Finding: Although framed as best practices, this section still normalizes the existence of a local `credentials.json` containing full-access Slack session credentials. The dangerous condition is not the advice itself but the sanctioned storage and operational use of highly sensitive reusable secrets in a local file.

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p ~/.config/agent-messenger

# Create credentials file
cat > ~/.config/agent-messenger/slack-credentials.json << 'EOF'
{
  "current_workspace": "T123456",
  "workspaces": {

• Confidence: 99% confidence
• Finding: These instructions tell users to manually create a file containing Slack token and cookie values, which are effectively live session secrets. Encouraging manual placement of such credentials into a plaintext file increases the chance of copy/paste exposure, shell history leakage, local compromise, and mishandling in automation or backups.

Credential Access

High

• Category: Privilege Escalation

Content

EOF

# Set secure permissions
chmod 600 ~/.config/agent-messenger/slack-credentials.json
```

If the user already has token values, they can populate the file above. Otherwise, always prefer `agent-slack auth extract` to obtain tokens automatically from the desktop app.

• Confidence: 96% confidence
• Finding: This line finalizes the creation of a local file that contains full-access Slack session credentials; while the `chmod` is protective, the underlying behavior is still sensitive credential storage. If an attacker or another process gains access to the file before or despite permission controls, they can impersonate the user across Slack workspaces.

Exfiltration Commands

High

• Category: Prompt Injection

Content

echo -e "${BOLD}${CYAN}Quick Actions:${NC}"
echo ""
echo -e "  ${GREEN}# Send message to a channel${NC}"
FIRST_CHANNEL=$(echo "$CHANNELS" | jq -r '.[0].name // "general"')
echo -e "  agent-slack message send $FIRST_CHANNEL \"Hello!\""
echo ""

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Quick Start encourages immediate execution of commands that can trigger authentication and access workspace data before the user is clearly warned about privacy and local credential use. In practice, this increases the chance of unintentional data access by users or agents following the examples verbatim.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## Authentication

Credentials are extracted automatically from the Slack desktop app on first use. No manual setup required — just run any command and authentication happens silently in the background.

On macOS, the system may prompt for your Keychain password the first time (required to decrypt Slack's stored token). This is a one-time prompt.

• Confidence: 80% confidence
• Finding: Telling an agent to 'run any command' in a tool that can authenticate silently and access Slack broadens operational scope without guardrails. In context, this can encourage the agent to invoke high-sensitivity commands such as snapshots, searches, or auth extraction without task-specific approval.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Memory

The agent maintains a `~/.config/agent-messenger/MEMORY.md` file as persistent memory across sessions. This is agent-managed — the CLI does not read or write this file. Use the `Read` and `Write` tools to manage your memory file.

### Reading Memory

• Confidence: 93% confidence
• Finding: The required cross-session memory file creates persistent state that can carry sensitive workspace context between tasks. This is risky in multi-tenant or mixed-task agent environments because prior Slack-derived information may influence or leak into later interactions outside the user’s expectations.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document says the CLI does not read or write the memory file, but then instructs the agent to do so on every task using external tools. This is risky because it obscures actual persistence behavior and can lead to unreviewed storage of workspace identifiers, preferences, and other sensitive context across sessions.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to retain workspace IDs, channel IDs, user IDs, aliases, and preferences in a natural-language memory file across sessions. Persistent free-form storage increases the chance of sensitive organizational context being leaked to unrelated tasks, exposed through other tools, or retained longer than intended.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly states that the skill authenticates by extracting Slack web session credentials directly from the local Slack desktop application, which is a sensitive credential-harvesting behavior well beyond ordinary message-sending or channel-reading flows. Because these xoxc/xoxd credentials grant full user-equivalent access across logged-in workspaces, the capability materially increases the attack surface and enables account takeover if abused or exfiltrated.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation introduces automatic extraction of Slack session credentials as a convenience feature without an immediate, prominent warning that it accesses highly sensitive tokens equivalent to active user sessions. This omission can mislead users into underestimating the security implications and consenting without informed understanding.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Security

- File permissions: `0600` (owner read/write only)
- Tokens are stored in plaintext (same as Slack desktop app)
- Keep this file secure - it grants full access to your Slack workspaces

• Confidence: 97% confidence
• Finding: The documentation explicitly states that tokens are stored in plaintext and grant full access to Slack workspaces, creating persistent session material on disk. This persistence increases the blast radius of any local compromise, malware infection, backup leak, or accidental disclosure because the attacker can reuse the tokens without reauthentication.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Telling users to grant Full Disk Access without a strong warning about the breadth of that permission normalizes an invasive step and can cause users to overexpose their system to the tool. Even if intended for troubleshooting, the absence of clear caution increases the chance of unsafe deployment and abuse.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

EOF

# Set secure permissions
chmod 600 ~/.config/agent-messenger/slack-credentials.json
```

If the user already has token values, they can populate the file above. Otherwise, always prefer `agent-slack auth extract` to obtain tokens automatically from the desktop app.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The workspace snapshot example describes broad workspace discovery, including users, channels, and recent messages, which exceeds the narrow expectation set by the manifest description of interacting with Slack channels and reactions. Under-described enumeration capabilities are dangerous because they enable large-scale collection of potentially sensitive organizational data without users realizing the breadth of access.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The snapshot example retrieves and prints workspace names, channel listings, users, and recent message content without any privacy warning or minimization guidance. In a Slack integration, this can expose sensitive organizational metadata and message contents, making the skill more dangerous because the documentation normalizes broad data access as a default first step.

Static analysis

No suspicious patterns detected.