Security audit

Slack

Security checks for vulnerabilities and agentic risk

Overview

This is a clearly documented Slack integration that uses Maton authentication and asks for approval before sensitive Slack actions, with ordinary third-party package install risk to consider.

Install only if you trust Maton and the package sources, prefer OAuth over API keys, grant Slack scopes narrowly, confirm every write or automation setup, and avoid trigger destinations to third-party hosts unless you explicitly want ongoing data forwarding there.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:34
Finding: CLI Installation from Third-Party Registries Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34-41 **Vulnerability Type**: Supply-chain risk from unverified executable dependencies **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @maton/cli@0.3.1 ``` ```bash brew install maton-ai/cli/maton brew pin maton ``` ### Technical Analysis The Skill directs users or agents to install an executable CLI globally from npm or from a vendor-controlled Homebrew tap. Although the npm version is pinned and the Homebrew package is subsequently pinned, the instructions provide no cryptographic checksum, artifact signature, immutable digest, or package-provenance verification. Version pinning prevents an unintended routine upgrade, but it does not protect against: - Compromise of the package publisher or registry account. - Replacement or republishing of a release artifact. - Compromise of the vendor-controlled Homebrew tap or formula. - A malicious installation or lifecycle script in the distributed package. - Registry or distribution infrastructure compromise. The CLI is especially sensitive because it subsequently performs OAuth authentication, accesses Maton connections, and processes Slack business data. A compromised executable would operate under the installing user's local privileges. ### Attack Path 1. An attacker compromises the npm publisher, Homebrew tap, release pipeline, or associated distribution account. 2. The attacker publishes or substitutes a malicious CLI artifact or formula. 3. A user or agent follows the installation command from `SKILL.md`. 4. Package installation or lifecycle code executes with the privileges of the invoking user. 5. The malicious CLI can inspect information available to that process, tamper with subsequent API operations, capture data supplied to the CLI, or impersonate expected command behavior. 6. When the user later authenticates or accesses Slack through the CLI, the compromised component may expose credentials, API responses, o ...[truncated 737 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish SHA-256 or stronger checksums for every supported CLI artifact and require verification before installation. 2. Sign releases using a verifiable mechanism such as Sigstore, npm provenance attestations, or platform-native signed release artifacts. 3. Document the expected npm publisher identity, Homebrew tap owner, package name, version, and verification procedure. 4. Prefer an isolated, non-global installation where practical instead of `npm install -g`. 5. Pin Homebrew artifacts to a reviewed immutable release rather than relying only on `brew pin` after installation. 6. Recommend installation under a dedicated, least-privilege user or isolated environment. 7. Provide a trusted release manifest containing artifact names, versions, hashes, and signatures. 8. Document an incident-response procedure for revoking Maton sessions and Slack connections if package integrity is later questioned. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:1894
Finding: SDK Dependencies Installed Without Cryptographic Integrity or Provenance Checks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 1894-1911 **Vulnerability Type**: Supply-chain risk from unverified SDK packages **Risk Level**: Medium ### Vulnerable Code ```bash pip install 'maton-ai==0.3.1' ``` ```bash npm install @maton/sdk@0.3.1 ``` ### Technical Analysis The optional Python and JavaScript SDK instructions install packages directly from public package-distribution channels. The versions are pinned, but the Skill supplies no hashes, signed provenance, lockfile integrity metadata, or verification instructions. These SDKs are imported into applications that authenticate to Maton and call Slack APIs. A malicious or compromised package can therefore execute when installed, imported, or invoked. Pinning a version does not independently verify that the retrieved artifact is the artifact reviewed by the Skill author. The Python example also supports constructing the SDK with an API key, while the JavaScript example exposes the same optional authentication pattern. Although the examples use placeholders rather than hardcoded credentials, a compromised SDK would run in the same process that holds those credentials. ### Attack Path 1. An attacker compromises the PyPI or npm publisher account, release pipeline, or distribution infrastructure. 2. A malicious package artifact is published or substituted under the expected package and version. 3. A developer follows the documented `pip install` or `npm install` instruction. 4. Malicious code executes during package installation, module import, SDK initialization, or an API call. 5. The compromised SDK observes application inputs, process environment variables, authentication state, and API responses. 6. It can exfiltrate Maton credentials or Slack data, alter requests, or perform unauthorized operations within the connected account's granted scope. ### Impact Assessment Exploitation could lead to application-level code execution with the privileges of the process using ...[truncated 582 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. For Python, publish a requirements file containing hashes and require installation with `pip install --require-hashes`. 2. For JavaScript, provide a reviewed lockfile with registry integrity values and require deterministic installation such as `npm ci`. 3. Enable and document signed package provenance or Sigstore attestations for both SDK releases. 4. Publish independent release checksums and verify them against downloaded artifacts. 5. Install SDKs in isolated virtual environments or containers with only the files and environment variables required for the task. 6. Avoid supplying long-lived API keys directly to application code where an OAuth-backed credential store is available. 7. Restrict the authenticated Maton account to only the Slack connections required by the application. 8. Add dependency monitoring and an explicit revocation procedure for sessions, API keys, and Slack connections following a suspected package compromise. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.