Security audit

slack-workspace-free

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly a Slack integration, but it needs review because it can post live Slack messages and expose workspace lists while its documentation has unclear scope and conflicting setup guidance.

Review this before installing. Use it only for explicit Slack tasks, confirm every message before posting, avoid sending sensitive channel or user data to callback URLs, and prefer a Slack OAuth connection with the minimum scopes needed for message sending and listing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation gives conflicting credential guidance: earlier sections say no API token is needed because ClawLink manages OAuth, while later sections instruct users to configure API keys manually. This can cause operators to create or expose unnecessary secrets, increasing the risk of credential leakage or misconfiguration.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill states the free/LITE version only supports basic Slack messaging and listing, but later advertises file read/write handling and file-processing capabilities. This mismatch can mislead an agent or user into attempting broader local file operations than intended, expanding the effective attack surface beyond the declared scope.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The skill description is broad and generic, with no tight trigger conditions limiting when Slack actions should be invoked. In an agent setting, vague activation language can cause the skill to be selected inappropriately and perform external operations in contexts where the user did not clearly intend Slack interaction.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes message sending without a prominent warning that this is an external write action to a live Slack workspace. In agent workflows, lack of explicit disclosure can lead to unintended outbound communication, accidental spam, or leakage of sensitive content to real users/channels.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented callback_url parameter enables transmitting results to an external endpoint, but the skill provides no warning about privacy, trust boundaries, or destination validation. This can lead to sensitive Slack-derived data being exfiltrated to attacker-controlled URLs or to insecure endpoints without informed user consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.