ClawHub
Back to skill

Security audit

slack-free

Security checks across malware telemetry and agentic risk

Overview

This Slack skill mainly does what it says, but its instructions also introduce unrelated file, API, and command-execution capabilities that broaden the agent’s authority beyond the stated Slack LITE purpose.

Install only if you are comfortable giving the agent live Slack posting and channel-history access through a Bot Token. Keep the bot scoped to the minimum Slack permissions and channels needed, verify every target channel/user and message before sending, and ignore the unrelated file/API/command-execution boilerplate unless the publisher narrows or removes it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill is presented as a narrowly scoped Slack messaging helper, but later sections expand it into generic file handling, API integration, and command execution. That mismatch can mislead an agent or user into believing broader actions are intended or authorized, increasing the chance of unsafe exec use or unintended access beyond Slack messaging.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The document says the LITE version does not support editing, deleting, pinning, or member queries, but later tables describe those operations as available. This inconsistency can cause agents to attempt unsupported or higher-risk actions, creating a dangerous authorization and expectation gap around Slack operations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explains how to read Slack messages but does not clearly warn that this may expose message contents, user IDs, timestamps, and other workspace data belonging to other users. In an agent context, that omission increases the risk of silent privacy-impacting retrieval and onward disclosure of internal communications.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill provides direct sendMessage instructions without clearly warning that execution will post real messages into live Slack channels or to users. In an automated agent workflow, this can lead to accidental spam, disclosure of sensitive information, or unauthorized communications in production workspaces.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.