ClawHub
Back to skill

Security audit

Slack Etiquette

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Slack etiquette guide for an already-authorized AI agent and does not add hidden access, code execution, persistence, or data handling.

Before installing, confirm the agent's Slack permissions, channel allowlists, and posting policy are configured separately. The skill itself is benign, but automatic replies and reactions can still create noise if the Slack integration is authorized too broadly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description is broad enough to activate in many ordinary Slack-monitoring contexts, which can cause the agent to apply this skill opportunistically across channels and DMs. Because the skill directly influences agent posting behavior in shared workspaces, over-broad triggering increases the chance of unnecessary surveillance-like participation, unwanted acknowledgements, and message/reaction spam at organizational scale.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal