Security audit

Slack

Security checks for vulnerabilities and agentic risk

Overview

This Slack integration is purpose-aligned and disclosed, but users should be careful with Slack credentials, message permissions, and Block Kit validation that sends drafts to Slack.

Install this only if you want OpenClaw connected to Slack. Use least-privilege Slack tokens, configure DM and channel allowlists, review enabled message actions and exec approvals, and avoid live Block Kit validation for sensitive drafts because validation sends the JSON to Slack.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to fetch live content from external Slack documentation pages, which expands the skill from static JSON authoring into network-enabled behavior. Even if the destinations are legitimate Slack domains, external retrieval introduces prompt-injection and data-exfiltration risk surfaces, because remote content can change and can influence the agent's behavior at runtime.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill directs the agent to POST developer-supplied payloads to Slack's blocks.validate API, causing outbound transmission of potentially sensitive draft content to a third party. This exceeds pure content generation and can leak proprietary text, internal workflow structure, IDs, or secrets accidentally embedded in payloads, especially because validation is framed as mandatory and automatic.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document says the live docs are the authoritative source and that payloads should be revalidated, yet it still presents a sample using a nonstandard block type (`alert`) that readers may copy into production. In a skill meant to proactively author and validate Slack Block Kit JSON, incorrect official-looking examples can cause failed message rendering, validation bypass assumptions, or downstream misuse when agents trust the sample more than the warning.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The manifest uses broad triggers such as any Slack UI component mention, the words 'blocks' or 'Block Kit Builder', and pasted JSON patterns, which can cause the skill to activate in ordinary conversations unrelated to requested network activity. In this skill, over-triggering is more dangerous because activation can lead to external fetches and API calls, increasing the chance of unintended data disclosure or execution of unnecessary network actions.

Static analysis

No suspicious patterns detected.