T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:123- Finding
Automatic Cross-Session Memory Loading and Modification
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Slackbot
Security checks for vulnerabilities and agentic risk
Overview
This Slack bot skill is coherent, but it needs Review because it recommends broad Slack permissions, stores bot tokens locally in plaintext, and directs automatic cross-session memory use.
Install only if a Slack administrator is comfortable with the exact scopes granted. Prefer a least-privilege Slack app, avoid private-channel and email scopes unless required, protect or avoid the plaintext credential file, keep it out of backups and shared environments, pin or verify the npm package where possible, and periodically clear or review the memory file for stale or incorrect channel/user aliases.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:97- Finding
Default Scope Set Grants Unnecessary Access to Private Data
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:9- Finding
Executable npm Dependency Is Not Version or Integrity Pinned
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broader Slack integration skill that can send messages, read channels, and manage reactions. However, this specific code chunk only posts a message to a Slack channel after checking CLI availability and bot authentication, then retrying on failure. There is no functionality for reading channel contents, listing channels, or adding/removing reactions. This is a description-to-behavior mismatch because the declared purpose materially overstates the implemented capabilities of the supplied code chunk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill documents local storage of Slack bot tokens in a JSON credentials file, which is credential material granting API access to one or more workspaces. Even with 0600 permissions, persistent plaintext token storage materially increases exposure from local compromise, accidental backup leakage, or unsafe file handling by other tools.
- Content
Configuration
Credentials stored in:
~/.config/agent-messenger/slackbot-credentials.jsonFormat:
json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The document explicitly states that bot credentials are saved locally in a JSON file containing plaintext tokens. Because this skill requests broad Slack scopes including private channel history and user email access, compromise of that file can give an attacker substantial access to workspace data and bot actions.
- Content
md 2. Calls `auth.test` to verify the token against Slack API 3. Stores the bot under the workspace with its bot ID and name 4. Sets this bot as the current active bot 5. Saves credentials to `~/.config/agent-messenger/slackbot-credentials.json` ## Credential Storage
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The documentation discloses a fixed credential file location and then describes storing sensitive bot tokens there in plaintext. In the context of a Slack bot with read access to public and private channels plus user information, theft of this file could enable unauthorized surveillance, impersonation, and data access within the workspace.
- Content
Location
text ~/.config/agent-messenger/slackbot-credentials.jsonFormat
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sh echo "" FIRST_CHANNEL=$(echo "$CHANNELS" | jq -r '.[0].id // "C123"') FIRST_CHANNEL_NAME=$(echo "$CHANNELS" | jq -r '.[0].name // "general"') echo -e " ${GREEN}# Send message to #$FIRST_CHANNEL_NAME${NC}" echo -e " agent-slackbot message send $FIRST_CHANNEL \"Hello!\"" echo "" echo -e " ${GREEN}# List recent messages${NC}"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The skill directs the agent to automatically read and write a persistent memory file at the start of every task, enabling cross-session retention of operational context and user-related metadata. This can lead to unintended data carryover, privacy leakage between tasks, and reliance on stale or sensitive state without fresh user approval.
- Content
md ## Memory The agent maintains a `~/.config/agent-messenger/MEMORY.md` file as persistent memory across sessions. This is agent-managed — the CLI does not read or write this file. Use the `Read` and `Write` tools to manage your memory file. ### Reading Memory
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs persistent storage of workspace IDs, channel IDs, user IDs, aliases, and user preferences across sessions without requiring user notice or consent. This creates a privacy and data-retention risk because identifiers and behavioral preferences can accumulate in a local memory file and be reused outside the user's immediate expectation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Creating a Slack App 1. Go to [api.slack.com/apps](https://api.slack.com/apps) 2. Click **Create New App** > **From scratch** 3. Enter app name and select workspace 4. Go to **OAuth & Permissions**
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Creating a Slack App 1. Go to [api.slack.com/apps](https://api.slack.com/apps) 2. Click **Create New App** > **From scratch** 3. Enter app name and select workspace 4. Go to **OAuth & Permissions**
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md ### Creating a Slack App 1. Go to [api.slack.com/apps](https://api.slack.com/apps) 2. Click **Create New App** > **From scratch** 3. Enter app name and select workspace 4. Go to **OAuth & Permissions**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation encourages use of environment variables for Slack bot tokens but does not warn that secrets can leak through shell history, process inspection, CI logs, debug output, or inherited environments. In this skill context, the token grants real bot access to Slack workspaces, so accidental exposure can let an attacker read channels, access user metadata, and post or react as the bot.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation demonstrates reading from and sending to Slack channels using a bot token, but it does not warn users that channel content and outbound messages are being transmitted through Slack APIs under the bot's credentials. In an agent setting, this can normalize handling potentially sensitive workspace data without user awareness or consent checks, increasing the risk of unintended data exposure or privacy violations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script silently enumerates channels and users and can emit the raw JSON, but provides no warning that it is collecting potentially sensitive workspace metadata. In a Slack bot skill, this makes accidental over-collection and onward sharing more dangerous because operators may run it without realizing the breadth of data being surfaced.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script enumerates all workspace users and includes them in JSON output and console summaries, which expands data access beyond a narrow channel/message/reaction interaction use case. Even if intended for convenience, bulk user listing increases exposure of directory information such as usernames, real names, and IDs that may be sensitive in some environments.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The script counts private channels by processing the full channel list, revealing the existence and number of private channels in the workspace. While it does not dump private channel contents here, metadata about private collaboration spaces can still disclose organizational structure or sensitive activity patterns.
- Content
Static analysis
No suspicious patterns detected.