Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Slack channel plugin whose Slack messaging, event handling, credentials, and Block Kit helpers are disclosed and aligned with its purpose.
Install only if you intend to connect OpenClaw to Slack and are comfortable granting the Slack app the configured scopes. Use least-privilege Slack tokens, keep DM and channel allowlists narrow, leave userTokenReadOnly enabled unless you need user-context writes, and review which message actions such as delete, edit, pins, file access, and native approvals are enabled.
The instruction to send a rich Slack message 'without waiting for the user to ask for Block Kit' encourages autonomous action under ambiguous conditions. That can lead the agent to choose a message-sending path prematurely, which is risky because the skill is connected to an outbound messaging tool and may alter how or where responses are delivered without sufficiently explicit consent.
The skill metadata says to use this capability proactively for structured or interactive Slack replies, which creates a broad auto-trigger surface rather than a narrowly scoped, user-driven invocation. In an agent system, overly broad proactive activation can cause the model to invoke the skill in routine conversations, increasing the chance of unwanted external actions, over-formatting, or channel-specific behavior without clear user intent.
The skill description contains very broad activation cues such as any Slack UI component mention, the words "blocks" or "Block Kit Builder," and pasted JSON like a section block. This can cause unintended invocation during ordinary Slack-related discussions or when arbitrary JSON is present, increasing the chance the agent switches into this skill unexpectedly and performs network lookups or produces irrelevant output.
This markdown file includes a pattern for shutting down a production server, which is a destructive operation that could affect system availability. Although the JSON example contains an in-UI confirmation dialog, the surrounding markdown description does not explicitly warn readers that this pattern is for irreversible or high-impact actions.
No suspicious patterns detected.
