Slack OpenAPI Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:06 AM UTC
• Version: 1.0.0

Overview

The skill is a real Slack API helper, but it asks users to connect Slack tokens through a mutable remote schema and can persist raw Slack event data locally.

Install only if you are comfortable granting Slack API access through UXC. Prefer a least-privilege bot token, avoid user tokens unless needed, confirm every write action, and use a pinned or local schema instead of the mutable GitHub main URL. If using Socket Mode, treat the NDJSON sink as sensitive Slack history and set restrictive permissions plus a short retention policy.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:123
• Finding: Runtime Use of a Mutable Remote OpenAPI Schema## Vulnerability Details **File Location**: `SKILL.md:123-127` **Additional Location**: `references/usage-patterns.md:5-9` **Vulnerability Type**: Supply-chain risk from an unpinned remote schema **Risk Level**: Medium **Vulnerable Code**: ```markdown 1. Use the fixed link command by default: - `command -v slack-openapi-cli` - If missing, create it: `uxc link slack-openapi-cli https://slack.com/api --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/slack-openapi-skill/references/slack-web.openapi.json` - `slack-openapi-cli -h` ``` The corresponding usage example is: ```bash command -v slack-openapi-cli uxc link slack-openapi-cli https://slack.com/api \ --schema-url https://raw.githubusercontent.com/holon-run/uxc/main/skills/slack-openapi-skill/references/slack-web.openapi.json slack-openapi-cli -h ``` ### Technical Analysis The project includes a local, auditable OpenAPI schema, but the documented setup retrieves the effective schema from the mutable `main` branch of a GitHub repository. The URL is neither pinned to an immutable commit nor protected by a documented integrity digest. The schema defines the available API paths, methods, request parameters, server configuration, and bearer authentication requirements. Consequently, the behavior used at runtime can change after this version of the Skill has been reviewed. Compromise of the upstream repository, its maintainer account, or its publishing workflow could cause users to receive a schema that differs from the audited local file. This does not directly retrieve and execute native code, so it is best classified as an insecure dependency rather than remote payload execution. Whether a malicious schema could redirect bearer credentials depends on UXC's independent enforcement of the command's Slack base URL and authentication binding. That enforcement is not implemented or verifiable within this project, so credential ...[truncated 1681 chars]
• Remediation: ## Remediation Suggestions 1. Use the bundled `references/slack-web.openapi.json` file as the default schema source. 2. If remote retrieval is necessary, pin the URL to an immutable Git commit rather than the `main` branch. 3. Publish and verify a SHA-256 digest before accepting the downloaded schema. 4. Configure UXC to enforce `https://slack.com/api` independently of any `servers` value contained in the schema. 5. Prevent schemas from changing credential hosts, authentication bindings, or transport destinations. 6. Validate the exact permitted operation allowlist after retrieval: - `/auth.test` - `/conversations.list` - `/conversations.info` - `/conversations.history` - `/conversations.replies` - `/chat.postMessage` - `/reactions.add` 7. Fail closed when the schema digest, server origin, security definition, or operation allowlist differs from the reviewed version.

T09 · Insecure Skill Coding Practices

Note

• Location: references/usage-patterns.md:99
• Finding: Persistent Plaintext Storage of Raw Slack Event Payloads## Vulnerability Details **File Location**: `references/usage-patterns.md:99-106` **Additional Location**: `SKILL.md:45-50` **Vulnerability Type**: Unprotected persistent storage of sensitive message data **Risk Level**: Low **Vulnerable Code**: ```markdown ## Socket Mode Subscribe ```bash # Start Slack Socket Mode using an app-level xapp token. # The runtime will call apps.connections.open automatically. uxc subscribe start https://slack.com/api \ --transport slack-socket-mode \ --auth slack-app \ --sink file:$HOME/.uxc/subscriptions/slack-socket-mode.ndjson ``` ``` The Skill also states that raw frames are captured and that the sink records message payloads: ```markdown - raw Socket Mode frame capture - automatic ack for envelopes that carry `envelope_id` ``` ### Technical Analysis The recommended Socket Mode workflow directs inbound Slack events to a persistent NDJSON file under the user's home directory. Slack event payloads can contain message text, channel and user identifiers, timestamps, thread data, and other workspace metadata. The instructions do not establish restrictive directory or file permissions, data minimization, redaction, encryption, rotation, retention periods, or secure deletion. The actual permissions may be affected by the user's `umask`, but the Skill does not verify that the resulting file is limited to the intended account. Persisting events is relevant to the declared subscription functionality, but retaining complete raw payloads is not necessarily the minimum privilege or minimum data handling required. A consumer may need only selected event fields or transient processing rather than indefinite raw-frame storage. ### Attack Path 1. A user configures the app-level Slack token and starts the documented Socket Mode subscription. 2. Slack sends message events and associated workspace metadata to the subscription. 3. UXC writes the complete event payloads to ` ...[truncated 1033 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user consent before enabling persistent capture of Slack events. 2. Create the sink directory with mode `0700` and the event file with mode `0600`. 3. Set and verify a restrictive `umask`, such as `077`, before creating the sink. 4. Prefer transient stream processing when permanent event storage is unnecessary. 5. Store only the fields required by the workflow instead of complete raw envelopes. 6. Redact message content and sensitive metadata where full payloads are not required. 7. Add size-based or time-based rotation and define a short default retention period. 8. Document secure deletion procedures and warn that backups may retain deleted records. 9. Consider encryption at rest when message payloads must be retained. 10. Detect unsafe existing files, including symbolic links or files owned by another account, and fail closed rather than appending to them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This code chunk’s primary function is static validation of a skill package: checking required files, verifying JSON schema structure with jq, and grepping for expected text patterns in SKILL.md and agent metadata. That is materially different from the declared purpose of operating the Slack Web API through UXC. While the checks reference Slack API setup details and guardrails, the script itself does not perform Slack API calls, bearer-token authentication, or messaging actions. Therefore the supplied code does not accurately represent the declared operational purpose.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The schema exposes both sensitive read capabilities (listing conversations, reading channel history, reading thread replies) and write capabilities (posting messages, adding reactions) using bearer-token authentication, but it contains no user-facing consent, warning, or scope-limiting mechanism in the skill artifact itself. In an agent setting, this increases the risk of unintended workspace surveillance or unauthorized posting if a prompt, workflow, or downstream component invokes these operations without clear user awareness and approval.

External Transmission

Medium

• Category: Data Exfiltration

Content

Use an app-level `xapp-...` token for Socket Mode subscriptions:

- Slack app page: `https://api.slack.com/apps`
- Path: `Basic Information -> App-Level Tokens`
- Recommended scope: `connections:write`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Use an app-level `xapp-...` token for Socket Mode subscriptions:

- Slack app page: `https://api.slack.com/apps`
- Path: `Basic Information -> App-Level Tokens`
- Recommended scope: `connections:write`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.