Security audit
Security checks for vulnerabilities and agentic risk
This Slack skill does what it says: it uses a Slack bot token to list channels, send messages, and create channels, with no hidden persistence or unrelated behavior found.
Install only with a Slack bot token scoped to the workspace and permissions you intend to expose. Treat message sending and channel creation as live workspace actions, and avoid giving the bot access to channels or data beyond what the integration needs.
The metadata and description overstate or mismatch actual behavior, including claiming workflow automation that is not evidenced here while omitting the required permissions for secret and network use. Such inconsistencies can mislead reviewers and users about what the skill does and what access it needs, which is a security-relevant integrity problem.
The skill declares access to an environment secret and relies on network communication, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and governance gap: the skill can use sensitive capabilities without clear user-visible restriction, increasing the risk of unintended secret access or outbound communications.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Setup
1. Create a Slack app at https://api.slack.com/apps
2. Get Bot User OAuth Token
3. Add required scopes: channels:read, chat:write, groups:read
4. Configure SLACK_BOT_TOKEN environment variable
The instructions describe capabilities to send messages and create/manage Slack channels, but they do not warn the user that these actions can affect real workspace resources and send externally visible communications. In an agent setting, omission of this warning increases the chance of unintended actions, social engineering, spam, or unauthorized workspace changes because the user may not realize the skill performs state-changing operations.
This code sends caller-provided text to an external Slack API endpoint, which can transmit user or system data off-host. There is no confirmation prompt, warning log, docstring, or inline comment disclosing that data will be sent to Slack.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload = {"channel": channel, "text": text}
try:
loop = asyncio.get_event_loop()
resp = await loop.run_in_executor(None, lambda: requests.post(url, headers=self.headers, json=payload, timeout=30))
data = resp.json()
if data.get("ok"):
return {"success": True, "ts": data.get("ts")}
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload = {"channel": channel, "text": text}
try:
loop = asyncio.get_event_loop()
resp = await loop.run_in_executor(None, lambda: requests.post(url, headers=self.headers, json=payload, timeout=30))
data = resp.json()
if data.get("ok"):
return {"success": True, "ts": data.get("ts")}
This function creates a new Slack channel via the Slack API, which is a remote state-changing action. The code lacks any confirmation prompt, warning, or explanatory comment/docstring informing users that it will create a channel in the workspace.
The skill reads the SLACK_BOT_TOKEN from the environment, which is a sensitive credential access. There is no surrounding comment, docstring, or user-facing notice indicating that the skill depends on and consumes this secret.
This function queries Slack for the workspace channel list, which accesses external organizational metadata. The code provides no user-facing warning, logging, or explanatory documentation indicating that workspace data will be retrieved from Slack.
No suspicious patterns detected.