Security audit

Slack Api Toolkit

Security checks across malware telemetry and agentic risk

Overview

This skill is a real Slack automation toolkit with powerful workspace-changing actions, but its scope and safeguards are too ambiguous for automatic installation.

Install only if you intentionally want an agent to operate a Slack workspace through the Slack gateway. Use least-privilege Slack scopes, a dedicated workspace connection, explicit channel/file/message IDs, and require human confirmation before delete, archive, bulk, or cross-workspace actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The documented output schema describes a generic code-review scoring report, while the rest of the skill performs Slack API actions such as file upload, deletion, scheduling, and search. This semantic mismatch can mislead an agent into selecting or invoking the skill under false assumptions, causing unintended external actions against a Slack workspace.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The paid-feature section advertises static analysis, vulnerability detection, CI/CD integration, and refactoring advice, but the skill is actually a Slack API operations toolkit. This kind of contradictory capability signaling increases the chance of accidental activation in unrelated contexts and may route sensitive user requests into a tool with message, file, and channel mutation capabilities.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The input definitions refer to generic review content and strictness levels rather than Slack-specific operation parameters. Ambiguous or inaccurate inputs can cause an agent to infer unsupported behavior and invoke the skill with arbitrary content, increasing the risk of unintended external or destructive actions.

Vague Triggers

High

Confidence: 93% confidence
Finding: The activation text is broad and generic, describing productivity, automation, workflow optimization, and structured output in a way that can match many unrelated prompts. Because the skill has exec, read, write, and external Slack capabilities, over-broad triggering materially raises the chance of unsafe invocation and unintended data or state changes.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The examples include destructive operations such as deleting files and deleting scheduled messages without prominent confirmation, dry-run, or impact warnings. In an agent setting, examples often become executable patterns; presenting destructive commands casually increases the likelihood of harmful copy-forward behavior.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises deletion, channel management, file operations, and bulk actions without prominent discussion of the operational impact on workspace data. In context, this is dangerous because the skill targets a live collaboration system where mistakes can affect many users, channels, or records at once.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.