Slack Thread Reader

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:16 AM UTC
• Version: 1.0.0

Overview

This Slack reader does what it advertises, but users should treat retrieved Slack conversations and the local Slack bot token as sensitive.

Install only if you are comfortable letting the skill use your local OpenClaw Slack bot token to read Slack channels or threads the bot can access. Use date and limit options for broad channels, avoid summarizing confidential conversations unless authorized, and remember that user identity mappings are cached locally for up to 24 hours.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context Leakage

High

• Category: Data Exfiltration

Content

- Thread link:   (channel, ts, None)        ← ts is the parent message
    - Reply link:    (channel, reply_ts, thread_ts) ← thread_ts is parent, reply_ts is child
    """
    # Extract thread_ts from query string (present means reply link)
    thread_ts = None
    qs = re.search(r'[?&]thread_ts=([^&]+)', link)
    if qs:

• Confidence: 75% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes scripts that fetch Slack data and documents capabilities implying network access and local cache writes, but it does not declare any explicit tool scope or permissions boundaries. That omission makes the effective access opaque to reviewers and increases the chance the skill is run with broader privileges than intended, especially when handling sensitive workplace communications.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill is specifically designed to retrieve and summarize Slack channel and thread history, which can include private or sensitive internal discussions, but the description and guidance do not warn about data sensitivity, authorization checks, or safe handling expectations. In this context, omission of privacy safeguards is risky because the skill encourages broad collection and summarization of conversation history, increasing the chance of unnecessary exposure or over-collection.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The code accesses a credential from ~/.openclaw/openclaw.json to authenticate to Slack, which is sensitive credential access. Although this is likely necessary for the skill's purpose, the visible usage/help text does not disclose that the command will read a local bot token from a config file.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill persists Slack user identity data to a local cache file under ~/.cache/slack-reader/users.json without disclosing that behavior in the usage text or output. This creates an unannounced local retention of potentially sensitive workspace metadata, which may be accessible to other local users, backups, or forensic tooling.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The manifest describes a skill for reading and summarizing Slack links and channel/thread history, but does not mention access to local credential/config storage. The code explicitly reads a bot token from ~/.openclaw/openclaw.json, which is an additional local secret-reading capability beyond the user-facing purpose.

Static analysis

No suspicious patterns detected.