T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/authentication.md:19- Finding
Automatic Extraction and Plaintext Storage of All Slack Workspace Session Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Slack
Security checks for vulnerabilities and agentic risk
Overview
This Slack skill should be reviewed carefully because it automatically extracts and stores Slack session credentials and contains unsafe, contradictory install guidance.
Install only after confirming you are comfortable with user-equivalent Slack access, automatic desktop-session credential extraction, plaintext local token storage, and broad workspace snapshots. Do not follow the template instructions to install the agent-slack package; use the intended agent-messenger package only, and avoid running snapshot/export templates from repositories, shared folders, CI workspaces, or synced directories.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T08 · Insecure Dependencies
Error
- Location
templates/monitor-channel.sh:134- Finding
Templates Recommend Installing a Known Unrelated Global Package
- Content
View full analysis
/dev/null; then echo -e "${RED}Error: agent-slack not found${NC}" echo "" echo "Install it with:" echo " bun install -g agent-slack" exit 1 fi ``` The same conflicting recommendation appears in `templates/post-message.sh:101-106`: ```bash if ! command -v agent-slack &> /dev/null; then echo -e "${RED}Error: agent-slack not found${NC}" echo "" echo "Install it with:" echo " bun install -g agent-slack" exit 1 fi ``` It also appears in `templates/workspace-summary.sh:30-35`: ```bash if ! command -v agent-slack &> /dev/null; then echo -e "${RED}Error: agent-slack not found${NC}" >&2 echo "" >&2 echo "Install it with:" >&2 echo " npm install -g agent-slack" >&2 exit 1 fi ``` ### Technical Analysis The project declares `agent-messenger` as the intended npm package and explicitly warns that `agent-slack` is a separate, unrelated package. Despite that warning, all three runnable templates instruct users to install `agent-slack` globally when the expected executable is absent. This creates a direct pa ...[truncated 2171 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:63- Finding
Untrusted Slack Metadata Can Be Persisted into Cross-Session Agent Memory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
templates/workspace-summary.sh:146- Finding
Workspace Summary Silently Persists a Full Slack Snapshot with Default Permissions
- Content
View full analysis
&2 SNAPSHOT=$(agent-slack snapshot 2>&1) if echo "$SNAPSHOT" | jq -e '.error' > /dev/null 2>&1; then echo -e "${RED}Failed to get snapshot${NC}" >&2 ERROR_MSG=$(echo "$SNAPSHOT" | jq -r '.error // "Unknown error"') echo -e "${RED}Error: $ERROR_MSG${NC}" >&2 exit 1 fi ``` It processes sensitive workspace data in `templates/workspace-summary.sh:65-75`: ```bash WORKSPACE_NAME=$(echo "$SNAPSHOT" | jq -r '.workspace.name // "Unknown"') WORKSPACE_ID=$(echo "$SNAPSHOT" | jq -r '.workspace.id // "Unknown"') CHANNELS=$(echo "$SNAPSHOT" | jq '.channels // []') CHANNEL_COUNT=$(echo "$CHANNELS" | jq 'length') PUBLIC_COUNT=$(echo "$CHANNELS" | jq '[.[] | select(.is_private == false)] | length') PRIVATE_COUNT=$(echo "$CHANNELS" | jq '[.[] | select(.is_private == true)] | length') USERS=$(echo "$SNAPSHOT" | jq '.users // []') USER_COUNT=$(echo "$USERS" | jq 'length') MESSAGES=$(echo "$SNAPSHOT" | jq '.recent_messages // []') ``` It then unconditionally writes the entire unfiltered snapshot in `templates/workspace-summary.sh:146-148`: ```bash SNAPSHOT_FILE="workspace-snapshot-$(date +%Y%m%d-%H%M%S).json" echo "$SNAPSHOT" > "$SNAPSHOT_FILE" echo -e "${GREEN}✓ Full snapshot saved to: $SNAPSHOT_FILE${NC}" ``` ### Technical Analysis The script is presented as a workspace-summary utility, but it always writes the complete raw Slack snapshot to the current working directory after displaying the formatted summary. This happens even when the user did not request JSON output or specify an output file. The snapshot includes workspace metadata, channels, users, and recent message content. The output f ...[truncated 1736 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (36)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the skill as interactive Slack messaging/reading, but the documented snapshot and reporting features enable workspace-wide enumeration of channels, users, and recent messages, with machine-readable JSON output suitable for bulk collection. That expansion materially increases privacy and exfiltration risk compared with the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the skill as interactive Slack messaging/reading, but the documented snapshot and reporting features enable workspace-wide enumeration of channels, users, and recent messages, with machine-readable JSON output suitable for bulk collection. That expansion materially increases privacy and exfiltration risk compared with the advertised purpose.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Automatically extracting Slack credentials from the desktop app and authenticating silently removes informed user consent at the point of credential access. This is especially dangerous because it may trigger access to stored tokens and cookies from local protected storage, enabling broad Slack access without an explicit warning or confirmation.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The documentation explicitly identifies a local credentials file containing Slack tokens and cookies. Exposing the path and format is not itself exploitation, but in a skill that can influence agent behavior it normalizes access to high-value secrets and increases the risk of credential theft or misuse if other tools can read local files.
- Content
Configuration
Credentials stored in:
~/.config/agent-messenger/slack-credentials.jsonFormat:
json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The Keychain-related guidance confirms the tool accesses protected local credential storage to recover Slack authentication material. In context, that is a high-sensitivity capability because compromise or misuse could grant workspace access without normal login flows.
- Content
md Common causes: - Slack desktop app is not installed or not logged in - macOS Keychain access was denied (re-run and approve the prompt) - Slack was installed via a method that uses a different storage path ### `agent-slack: command not found`
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These steps instruct the tool to locate Slack local storage, read LevelDB session data, decrypt cookies via macOS Keychain, validate them, and save xoxc/xoxd secrets for all logged-in workspaces. This is effectively credential harvesting from another application's private session store, and successful exploitation yields persistent authenticated access to potentially multiple Slack tenants as the victim user.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This line confirms that extracted Slack session credentials are saved to a local JSON file after being harvested from the desktop client. Storing reusable xoxc/xoxd session material enables persistent compromise if the file is read, copied, backed up insecurely, or exposed through other local processes.
- Content
md 4. Decrypts cookies using macOS Keychain (for sandboxed App Store version) 5. Validates tokens against Slack API before saving 6. Extracts xoxc token and xoxd cookie for ALL logged-in workspaces 7. Stores credentials securely in `~/.config/agent-messenger/slack-credentials.json` ### Platform-Specific Paths
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The documentation advertises a fixed filesystem location for a file containing Slack session credentials. Publicly documenting the location of a high-value secrets file lowers the effort needed for malware, insider abuse, or accidental leakage to locate and exfiltrate those credentials.
- Content
Credentials are stored in:
text ~/.config/agent-messenger/slack-credentials.jsonFormat
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guidance tells users to grant the terminal Full Disk Access so the tool can read Slack app data, expanding host-level access far beyond normal Slack messaging needs. This permission increase weakens endpoint protections and can expose many unrelated sensitive files to the tool or anything running in that terminal context.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Although framed as best practices, this section still normalizes the existence of a local
credentials.jsoncontaining full-access Slack session credentials. The dangerous condition is not the advice itself but the sanctioned storage and operational use of highly sensitive reusable secrets in a local file.- Content
md ### Best Practices 1. **Protect credentials.json**: Never commit to version control 2. **Use workspace switching**: Don't mix personal/work contexts 3. **Re-extract periodically**: Keep tokens fresh 4. **Revoke if compromised**: Log out of Slack desktop app to invalidate tokens
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
These instructions tell users to manually create a file containing Slack token and cookie values, which are effectively live session secrets. Encouraging manual placement of such credentials into a plaintext file increases the chance of copy/paste exposure, shell history leakage, local compromise, and mishandling in automation or backups.
- Content
md mkdir -p ~/.config/agent-messenger # Create credentials file cat > ~/.config/agent-messenger/slack-credentials.json << 'EOF' { "current_workspace": "T123456", "workspaces": {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
This line finalizes the creation of a local file that contains full-access Slack session credentials; while the
chmodis protective, the underlying behavior is still sensitive credential storage. If an attacker or another process gains access to the file before or despite permission controls, they can impersonate the user across Slack workspaces.- Content
EOF
Set secure permissions
chmod 600 ~/.config/agent-messenger/slack-credentials.json
text If the user already has token values, they can populate the file above. Otherwise, always prefer `agent-slack auth extract` to obtain tokens automatically from the desktop app.
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sh echo -e "${BOLD}${CYAN}Quick Actions:${NC}" echo "" echo -e " ${GREEN}# Send message to a channel${NC}" FIRST_CHANNEL=$(echo "$CHANNELS" | jq -r '.[0].name // "general"') echo -e " agent-slack message send $FIRST_CHANNEL \"Hello!\"" echo ""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Quick Start encourages immediate execution of commands that can trigger authentication and access workspace data before the user is clearly warned about privacy and local credential use. In practice, this increases the chance of unintentional data access by users or agents following the examples verbatim.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Telling an agent to 'run any command' in a tool that can authenticate silently and access Slack broadens operational scope without guardrails. In context, this can encourage the agent to invoke high-sensitivity commands such as snapshots, searches, or auth extraction without task-specific approval.
- Content
md ## Authentication Credentials are extracted automatically from the Slack desktop app on first use. No manual setup required — just run any command and authentication happens silently in the background. On macOS, the system may prompt for your Keychain password the first time (required to decrypt Slack's stored token). This is a one-time prompt.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 93% confidence
- Finding
The required cross-session memory file creates persistent state that can carry sensitive workspace context between tasks. This is risky in multi-tenant or mixed-task agent environments because prior Slack-derived information may influence or leak into later interactions outside the user’s expectations.
- Content
md ## Memory The agent maintains a `~/.config/agent-messenger/MEMORY.md` file as persistent memory across sessions. This is agent-managed — the CLI does not read or write this file. Use the `Read` and `Write` tools to manage your memory file. ### Reading Memory
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document says the CLI does not read or write the memory file, but then instructs the agent to do so on every task using external tools. This is risky because it obscures actual persistence behavior and can lead to unreviewed storage of workspace identifiers, preferences, and other sensitive context across sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to retain workspace IDs, channel IDs, user IDs, aliases, and preferences in a natural-language memory file across sessions. Persistent free-form storage increases the chance of sensitive organizational context being leaked to unrelated tasks, exposed through other tools, or retained longer than intended.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation explicitly states that the skill authenticates by extracting Slack web session credentials directly from the local Slack desktop application, which is a sensitive credential-harvesting behavior well beyond ordinary message-sending or channel-reading flows. Because these xoxc/xoxd credentials grant full user-equivalent access across logged-in workspaces, the capability materially increases the attack surface and enables account takeover if abused or exfiltrated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation introduces automatic extraction of Slack session credentials as a convenience feature without an immediate, prominent warning that it accesses highly sensitive tokens equivalent to active user sessions. This omission can mislead users into underestimating the security implications and consenting without informed understanding.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The documentation explicitly states that tokens are stored in plaintext and grant full access to Slack workspaces, creating persistent session material on disk. This persistence increases the blast radius of any local compromise, malware infection, backup leak, or accidental disclosure because the attacker can reuse the tokens without reauthentication.
- Content
md ### Security - File permissions: `0600` (owner read/write only) - Tokens are stored in plaintext (same as Slack desktop app) - Keep this file secure - it grants full access to your Slack workspaces
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Telling users to grant Full Disk Access without a strong warning about the breadth of that permission normalizes an invasive step and can cause users to overexpose their system to the tool. Even if intended for troubleshooting, the absence of clear caution increases the chance of unsafe deployment and abuse.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
EOF
Set secure permissions
chmod 600 ~/.config/agent-messenger/slack-credentials.json
text If the user already has token values, they can populate the file above. Otherwise, always prefer `agent-slack auth extract` to obtain tokens automatically from the desktop app.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workspace snapshot example describes broad workspace discovery, including users, channels, and recent messages, which exceeds the narrow expectation set by the manifest description of interacting with Slack channels and reactions. Under-described enumeration capabilities are dangerous because they enable large-scale collection of potentially sensitive organizational data without users realizing the breadth of access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The snapshot example retrieves and prints workspace names, channel listings, users, and recent message content without any privacy warning or minimization guidance. In a Slack integration, this can expose sensitive organizational metadata and message contents, making the skill more dangerous because the documentation normalizes broad data access as a default first step.
- Content
Static analysis
No suspicious patterns detected.