Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- tests/test_canvas.py:35
- Evidence
spec.loader.exec_module(m)
Security audit
Slack Canvas
Security checks for vulnerabilities and agentic risk
Overview
This plugin is a disclosed Slack Canvas MCP integration that writes configured channel canvases and local state for that purpose.
Install only if you intend agents to update Slack channel canvases. Configure only the Slack channel IDs the agent should touch, use a least-privilege bot token, keep HTTP mode on loopback with a strong SLACK_CANVAS_HTTP_TOKEN, and set archive paths only to locations where closed-topic history is appropriate.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dynamic_code_execution