Slack Integration

Slack integration - Send messages, manage channels, and automate Slack workflows

Security Scan

The skill's code, declared requirements, and instructions are consistent with a Slack bot integration and do not request unrelated credentials or perform unexpected actions.

Purpose & Capability

Name/description match the included code and declared environment variable (SLACK_BOT_TOKEN). Tools exposed (send message, list/create channels) map directly to Slack API endpoints used in slack.py; there are no unrelated env vars or system paths requested.

Instruction Scope

SKILL.md stays on-topic (set up Slack app, provide bot token). The documentation lists some scopes but omits the scope needed to create channels (the code calls conversations.create which generally requires conversations:write or channels:write); otherwise the instructions do not ask the agent to read local files or other credentials.

Install Mechanism

No install spec (low risk). The runtime imports the third-party 'requests' library but there is no declared dependency or installer; the code handles absence by returning an error. This is an operational shortcoming, not a security red flag.

Credentials

Only SLACK_BOT_TOKEN is required, which is proportional to the skill's functionality. The token is used only for calls to api.slack.com and no other credentials or secrets are requested.

Persistence & Privilege

Skill is not forced-enabled (always: false), does not request system-wide configuration changes, and uses normal autonomous invocation defaults. It does not modify other skills or global agent settings.

Assessment

This skill appears to do what it says, but review and follow these precautions before installing: 1) Provide a Bot User OAuth token scoped with least privilege — ensure required scopes include chat:write and the appropriate conversations/channels write/read scopes (the SKILL.md misses the write scope needed to create channels). 2) Use a bot token (not your personal user token), limit its workspace permissions, and rotate/revoke it if abused. 3) Review the GitHub source (homepage) and confirm you trust the author before supplying a token. 4) Ensure the runtime has the 'requests' library available or the skill will return errors. 5) Be aware the skill will make network calls to api.slack.com (expected behavior); restrict token usage in sensitive workspaces if you are concerned about accidental message posting or channel creation.

Slack integration skill for OpenClaw. Send messages, manage channels, and automate Slack workflows.

Setup

1. Create a Slack app at https://api.slack.com/apps
2. Get Bot User OAuth Token
3. Add required scopes: channels:read, chat:write, groups:read
4. Configure SLACK_BOT_TOKEN environment variable