Slack Extended

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:04 PM UTC
• Version: 0.1.1

Overview

This Slack skill does what it says, but it can upload chosen local files and change or delete Slack collaboration content when invoked.

Install only for a Slack workspace where the configured bot token should be allowed to upload files, create and edit canvases, change canvas access, and add or remove bookmarks. Before using it, verify file paths to avoid sharing private local data, and treat canvas delete, bookmark remove, and access changes as potentially destructive or visibility-changing actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code chunk’s behavior is narrowly focused on bookmark management in Slack channels. It does not upload files, create canvases, edit canvases, or interact with any Slack APIs related to files or canvases. The bookmark portion of the description is accurate, but the overall declared description overstates the skill’s capabilities by including file and canvas management. This is a material description/behavior mismatch because the declared primary purpose includes major capabilities absent from the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code chunk accurately supports part of the declared purpose—Slack canvas creation, editing, deletion, section lookup, and access control. However, it does not implement file upload or bookmark management, both of which are explicitly claimed in the description. This makes the declared description materially broader than the actual behavior of the provided code chunk. The implemented access-setting capability is adjacent to canvas management, so it is not a major concern, but the missing file and bookmark functionality means the description does not accurately represent this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The code chunk accurately supports the 'upload files' portion of the description, but there is no functionality for creating/editing canvases or adding/organizing bookmarks. This makes the supplied code materially narrower than the declared purpose. There are no obvious undeclared harmful capabilities beyond reading the configured Slack bot token and uploading the specified file, which are supporting details for the file upload behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares credentialed Slack API access and describes direct API-calling scripts, but it does not declare an explicit tool scope or allowed-tools boundary despite requiring network capability. That weakens policy enforcement and reviewability, making it easier for a skill with powerful OAuth scopes to perform unintended external actions without clear sandbox constraints.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill prominently documents uploading arbitrary local files to Slack but does not warn that using `--file` can exfiltrate sensitive local data to an external workspace. In an agent setting, that omission increases the risk of accidental disclosure of secrets, reports, credentials, or private user data through a seemingly routine sharing action.

Session Persistence

Medium

• Category: Rogue Agent

Content

Manage Slack canvases (collaborative documents):

### Create a canvas

```bash
python3 /mnt/openclaw/skills/slack-extended/scripts/slack_canvas.py create \

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation includes canvas deletion as a normal operation without highlighting that it is destructive and may be irreversible or difficult to recover depending on Slack retention and permissions. In an autonomous or semi-autonomous workflow, that raises the chance of accidental data loss affecting shared collaboration artifacts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The remove command performs an irreversible Slack bookmark deletion via `bookmarks.remove` and immediately reports success, but there is no confirmation prompt or explicit warning comment/docstring describing the destructive effect. The top-level docstring lists usage examples, but it does not warn that `remove` deletes channel bookmarks.

Session Persistence

Medium

• Category: Rogue Agent

Content

"""Create, edit, delete, and manage Slack canvases.

Usage:
    python3 slack_canvas.py create --title "Sprint Notes" --markdown "## Goals\\n- Ship feature X"
    python3 slack_canvas.py edit --canvas-id F123 --operation insert_at_end --markdown "New content"
    python3 slack_canvas.py edit --canvas-id F123 --section-id S123 --operation replace --markdown "Updated"
    python3 slack_canvas.py delete --canvas-id F123

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The delete command issues a Slack API request to remove a canvas, which is an irreversible operation affecting user data. While the module docstring lists the command usage, the code provides no confirmation prompt or explicit warning at the point of deletion.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The access command modifies who can read or write a canvas via Slack's API, which can expose or alter user data. The code executes this permission change without any confirmation prompt or clear warning that it affects sharing and edit rights.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The module usage example documents `python3 slack_canvas.py access --canvas-id F123 --channel C123 --level edit`, implying `edit` is a valid access level. However, the actual argument parser only accepts `read` or `write` for `--level`, so the documentation contradicts the implemented behavior rather than merely omitting detail.