ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Slack Channel Context

v1.0.0

Automatically loads Slack channel context files (e.g., bebops.md, C0AK8SDFS4W.md) into session context for Slack channels and threads. Use this skill wheneve...

⭐ 1· 64·0 current·0 all-time
byBrian@hirebrianm
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description align with implementation: the code looks up <CHANNEL_ID>.md and <CHANNEL_NAME>.md in a slack-channel-contexts directory and returns the file contents. No unrelated credentials or binaries are requested.
ℹ
Instruction Scope
The docs imply the skill 'detects when you're in a Slack channel or thread', but the implementation is a library/helper that accepts message metadata (channel_id/channel_name) and does not itself connect to Slack or listen to events. Also there are small documentation inconsistencies (e.g., cache TTL shown as 7200 in one place and 3600 in others, and mixed guidance about using export vs writing .env). These are documentation quality issues rather than malicious behavior.
✓
Install Mechanism
No install spec or external downloads are used. The skill is instruction+code only and runs locally; there are no remote URLs or packages being fetched at runtime.
✓
Credentials
The skill does not require secrets or credentials. It reads optional configuration environment variables (SLACK_CONTEXT_* ) that control local behavior; none are required to function. This is proportionate to the stated purpose.
✓
Persistence & Privilege
always:false and agent invocation defaults are normal. The skill will create and write a README.md and create the slack-channel-contexts directory under the user's workspace if missing (its own data area) — expected for a local context manager and limited in scope.
Assessment
This skill is internally consistent and appears safe to install, but review the following before enabling: (1) it will read any Markdown files in ~/.openclaw/workspace/slack-channel-contexts/ (or a custom SLACK_CONTEXT_CONTEXTS_DIR) and inject that text into agent session context — do not store secrets or sensitive data in those files; (2) the skill may create the contexts directory and write a README.md there the first time it runs; (3) the skill is a helper library and does not itself connect to Slack — your Slack integration must call load_channel_context and pass message metadata; (4) documentation has minor inconsistencies (cache TTL default and .env handling), so verify environment variables are set to the values you expect. If you want to be cautious, inspect the skill's scripts (present in the package) and disable it in openclaw.json or set SLACK_CONTEXT_ENABLED=false until you're ready.

Like a lobster shell, security has layers — review code before you run it.

latestvk972h22c1s76f50bfh1qcq8zw183prps

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments