Security audit

Slack

Security checks across malware telemetry and agentic risk

Overview

This Slack skill is broadly coherent, but it advertises real Slack write and management actions while declaring only read access and giving little control or privacy guidance.

Review this before installing if you expect a read-only Slack helper. Use it only where Slack write actions are intended, and require explicit user confirmation before sending, editing, deleting, pinning, unpinning, or reacting to messages. Treat member information as workplace-sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest declares only the `read` tool, but the documentation advertises write-capable Slack actions such as sending, editing, deleting, pinning, and reacting to messages. This mismatch can mislead reviewers and users about the skill’s true operational scope, undermining permission transparency and enabling unexpected external side effects if the runtime wires in broader capabilities.

Scope Creep

High

Confidence: 99% confidence
Finding: The documented capabilities materially exceed the declared permission scope of `read`, indicating a scope/permission inconsistency. In agent ecosystems, this creates a security risk because operators may approve or trust the skill based on the manifest while the instructions steer the agent toward broader, potentially destructive Slack operations.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: The skill advertises retrieval of member information without any privacy notice or guidance on handling personal/workplace data. While common in Slack integrations, omission of privacy context can lead to unnecessary collection or disclosure of employee directory information in environments with compliance or confidentiality requirements.

Missing User Warnings

Low

Confidence: 76% confidence
Finding: The skill advertises retrieval of member information without any privacy notice or guidance on handling personal/workplace data. While common in Slack integrations, omission of privacy context can lead to unnecessary collection or disclosure of employee directory information in environments with compliance or confidentiality requirements.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The skill notes external network/service access only later in the document instead of warning up front that actions will operate against Slack, an external service. This weakens informed consent and can surprise users with outbound actions affecting real organizational systems.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.