Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Slack integration package whose Slack access and message features are disclosed and aligned with its purpose.
Install only in workspaces where you are comfortable granting the configured Slack app its scopes. Prefer bot tokens over user tokens, keep allowlists and DM/channel policies tight, review history limits, and require confirmation for destructive Slack actions in your workflows.
The description says to use the skill proactively for structured or interactive Slack replies, which is broad enough to trigger the skill in situations where the user did not clearly request Slack formatting. That can cause unnecessary tool use and unexpected message delivery behavior, especially in shared communication contexts like Slack.
The skill description contains very broad activation cues such as any Slack UI component mention, the words "blocks" or "Block Kit Builder," and pasted JSON patterns. This can cause the skill to trigger on ordinary discussion or unrelated JSON, leading the agent to enter a specialized workflow unexpectedly and potentially override the user's intended task or increase exposure to prompt-injection content embedded in matched inputs.
The instruction to send a rich message 'without waiting for the user to ask for Block Kit' encourages autonomous formatting and potentially autonomous sending behavior beyond explicit user consent. In a Slack-integrated environment, this increases the risk of unintended external communication, confusing user expectations, and accidental disclosure of content into channels.
The Approval Message template includes a destructive Reject button styled as dangerous but does not attach a confirmation dialog, making accidental rejection more likely. In a Slack Block Kit skill that provides copyable scaffolds, this can propagate unsafe UX into real approval workflows, causing unintended denial of requests or operational disruption.
No suspicious patterns detected.
