Security audit
Slack
Security checks across malware telemetry and agentic risk
Overview
This official OpenClaw Slack plugin does what it says: connects OpenClaw to Slack so agents can receive events and perform configured Slack actions.
Install only in Slack workspaces where you are comfortable giving the configured bot/app token the listed Slack scopes. Keep tokens in OpenClaw secrets or environment variables, prefer bot tokens over user tokens, keep userTokenReadOnly enabled unless needed, restrict allowed channels/DM users, and be deliberate before enabling message delete/edit/pin actions or Slack-based exec approvals.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
58/58 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.