Security audit
Security checks for vulnerabilities and agentic risk
This Slack skill is a coherent integration, but it gives an agent broad Slack posting, search, user lookup, and file-upload abilities without enough confirmation and privacy guardrails.
Review this before installing in a real workspace. Grant only the Slack scopes you need, avoid broad search/read scopes unless necessary, require explicit confirmation before posting, deleting, searching, or uploading files, and treat all bot tokens as secrets that must not be pasted into prompts, logs, screenshots, or shared docs.
The examples expose personally identifiable information such as names, email addresses, job titles, timezones, and Slack user IDs, while the setup section includes credential-like secrets. In a messaging/search skill, this is more dangerous because the documented outputs normalize returning sensitive workspace data verbatim and can lead to overexposure of internal identities, message metadata, and secrets.
The skill advertises sensitive capabilities without prominent warnings that they may expose workspace metadata, personal information, message contents, or local files to Slack. Users may invoke these operations without understanding the privacy and data-handling consequences, especially because the skill can act on local file paths and search internal communications.
The description states 'All in English,' which imposes a language constraint as a policy decision rather than offering a choice. The document does not explain a justified regional requirement or provide an opt-in mechanism for language selection.
The trigger model allows any 'reasonable paraphrase' to invoke capabilities, including privacy- and action-impacting operations like message search, user lookup, file upload, and message posting. Broad activation increases the risk of unintended execution from ambiguous prompts or prompt injection routed through natural-language interpretation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You must create a Slack App with a Bot Token before using this skill.
1. Go to **https://api.slack.com/apps** and click **Create New App** → **From scratch**.
2. Give the app a name (e.g., "OpenClaw Integration"), pick your workspace, and click **Create App**.
3. Under **Features**, click **OAuth & Permissions** in the left sidebar.
4. Scroll to **Bot Token Scopes** and add these scopes depending on which capabilities you need:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
You must create a Slack App with a Bot Token before using this skill.
1. Go to **https://api.slack.com/apps** and click **Create New App** → **From scratch**.
2. Give the app a name (e.g., "OpenClaw Integration"), pick your workspace, and click **Create App**.
3. Under **Features**, click **OAuth & Permissions** in the left sidebar.
4. Scroll to **Bot Token Scopes** and add these scopes depending on which capabilities you need:
The skill is explicitly designed to transmit data to Slack's external API, including message content and authorization credentials. External transmission is expected for this integration, but it remains security-relevant because user prompts, local file contents, and workspace data may leave the local environment and be disclosed to a third-party service.
# Always include the Authorization header with the Bot Token
curl -s -X POST 'https://slack.com/api/chat.postMessage' \
-H 'Authorization: Bearer xoxb-your-token' \
-H 'Content-Type: application/json; charset=utf-8' \
-d '{
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
### Step-by-Step Setup
**Step 1: Create a Slack App**
1. Go to https://api.slack.com/apps and click **Create New App**
2. Select **From scratch** (not "From an app manifest")
The installation example includes realistic-looking Slack bot credentials and a signing secret in plaintext. Even if illustrative, publishing credential-shaped values normalizes unsafe handling, risks accidental reuse, and can lead operators to expose secrets in docs, prompts, screenshots, or logs.
The capabilities section says the skill 'performs only the capability requested; it never combines unrelated operations,' yet multiple documented behaviors require auxiliary actions such as validating a channel, looking up a user by email, or resolving IDs before sending or scheduling messages. Those helper operations are part of the actual workflow, so the statement is stricter than what the rest of the document describes.
The installation guide shows realistic secret values without an explicit admonition that they are examples only and must never be shared. This encourages unsafe credential practices and increases the chance of secrets being copied into insecure places or mistaken for valid defaults.
No suspicious patterns detected.