ClawHub
Back to skill

Security audit

Slackbot

Security checks for vulnerabilities and agentic risk

Overview

This Slack skill is purpose-aligned, but it grants broad workspace read/write access and underplays sensitive read operations as confirmation-free.

Install only if you trust ClawLink and are comfortable granting an agent broad Slack workspace access. Review the live plugin source/provenance and Slack OAuth scopes first, prefer least-privilege workspace permissions, and require confirmation before searches, message history reads, file downloads/public sharing, posting, membership changes, or deletes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:35
Finding

Unpinned Third-Party Plugin Installation and Authorization

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–37
Vulnerability Type: Unverified and unpinned third-party dependency
Risk Level: High

bash
openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The installation procedure dynamically resolves clawlink-plugin from an external package registry without specifying an immutable version, digest, checksum, or signature. It then explicitly adds that plugin to the allowed-tool configuration and restarts the gateway, activating externally supplied executable code.

The project contains only SKILL.md; it does not include the plugin source or verifiable provenance information. Consequently, the implementation installed by these commands cannot be matched to code reviewed in this audit. Its effective behavior could change after review if the registry package is updated or compromised.

This is a supply-chain trust issue rather than evidence that the current external plugin is malicious.

Attack Path

  1. An attacker compromises the external registry, the plugin publisher account, or the plugin's release pipeline.
  2. The attacker publishes a malicious release under the expected clawlink-plugin identifier.
  3. A user follows the documented command, which resolves the package without an immutable version or integrity constraint.
  4. The user explicitly authorizes the installed plugin through tools.alsoAllow.
  5. Restarting the gateway loads and activates the compromised component.
  6. The component can attempt to abuse the runtime privileges and OAuth-backed integration access granted to it.

Impact Assessment

A compromised plugin could execute within the OpenClaw plugin environment and access resources exposed to that environment. Based on the documented integration capabilities, the affected scope may include Slack messages, channels, user details, files, private con ...[truncated 262 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the plugin to an audited immutable version or content digest rather than resolving a mutable package name.
  2. Require cryptographic signature verification and publish the expected checksum through a separately controlled channel.
  3. Document the authoritative registry, publisher identity, source repository, and reproducible relationship between source and package.
  4. Review the plugin source and permission manifest before adding it to tools.alsoAllow.
  5. Apply least privilege to both OpenClaw tool permissions and Slack OAuth scopes.
  6. Isolate the plugin runtime and restrict filesystem, process, network, and secret access to what the integration strictly requires.
  7. Maintain an approved-version policy and alert on unexpected package, publisher, signature, or digest changes.
  8. Avoid automatically activating newly resolved code; require explicit review before gateway restart and plugin enablement.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description broadly recommends use for Slack automation without clearly constraining when access to workspace data and messaging capabilities is appropriate. In an agent setting, vague invocation guidance can cause over-selection of a high-privilege integration, leading to unnecessary access to messages, files, channels, and user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description highlights automation features but omits a clear privacy warning that read and search tools can access potentially sensitive workspace content, including messages, files, user profiles, and channel membership. This can mislead users or downstream agents into treating the integration as routine automation rather than a data-access capability with substantial confidentiality implications.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The skill explicitly states that read operations, including listing channels, reading messages, searching content, listing files, and retrieving user details, are 'safe' and require no confirmation. In a Slack workspace, these actions can expose sensitive business communications, attachments, private metadata, and personal data; labeling them as confirmation-free materially increases the risk of unauthorized surveillance or bulk data access by an agent.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
## Security & Permissions

- **Read** operations (listing channels, messages, users, files, searching) are safe and require no confirmation.
- **Write** operations (sending messages, creating channels, scheduling, managing reactions) modify data and require confirmation.
- **Destructive** operations (deleting messages, files, canvases, scheduled messages) are high-impact and irreversible.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.

md
## Resources

- Slack API Docs: https://api.slack.com/docs
- ClawLink: https://claw-link.dev/?utm_source=clawhub&utm_medium=referral&utm_content=slackbot
- ClawLink Docs: https://docs.claw-link.dev/openclaw

Static analysis

No suspicious patterns detected.