slack

ISSUES FOUND max severity HIGHSkillSpector Caution 11 registry clawhub.ai last scanned 2026-02-07 1 scan

4 findings (2 high, 2 medium), mainly data exfiltration, social engineering, unauthorized tool use. Most recent scan 2026-02-07.

This Slack integration skill presents SIGNIFICANT SECURITY CONCERNS due to its architecture of routing all Slack API requests through a third-party gateway (maton.ai). The primary risks are: (1) Data exfiltration - all Slack workspace data flows through an external service with no visibility into logging or storage practices, (2) Credential exposure - the gateway has persistent access to OAuth tokens and can perform any Slack operation, (3) Misleading description - the skill appears to be a standard Slack integration but actually introduces a third-party intermediary with full workspace access. Additional concerns include hardcoded API key patterns in documentation, a missing referenced Python file (Slack.py), and lack of transparency about the trust model. While the skill may be functional, the security implications of using a third-party OAuth proxy for enterprise Slack workspaces are severe. The skill is NOT RECOMMENDED for production use without significant security enhancements and clear disclosure of the proxy architecture.
Scanner's overall assessment (LLM analyzer)

Findings4

Critical0

High2

Medium2

Low0

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 11

Score11 / 100

Issues15

CategoriesData Exfiltration

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Slack API integration with managed OAuth. Send messages, manage channels, search conversations, and interact with Slack workspaces. Use this skill when users want to post messages, list channels, get user info, or automate Slack workflows.

Package: 2 files, 8.0 KB
SKILL.md: 699 words, 12+ sections
Code: None. Instructions only.
Compatibility: Requires network access and valid Maton API key

SKILL.md covers: Slack · Quick Start · Post a message to a channel · Base URL · Authentication · Getting Your API Key · Connection Management · List Connections · Create Connection · Get Connection · Delete Connection · Specifying Connection

Findings

HIGH Hardcoded API Key Exposure Risk in Documentation Data Exfiltrationllm

The skill documentation contains multiple examples showing 'YOUR_API_KEY' placeholders and instructs users to set MATON_API_KEY as an environment variable. While the examples use placeholders, the skill's reliance on a third-party API gateway (maton.ai) for OAuth token management creates a credential exposure risk. All Slack API requests are proxied through gateway.maton.ai with the user's API key, meaning the gateway has access to both the Maton API key and the OAuth tokens for Slack workspaces. This creates a single point of failure where compromise of the gateway or API key leads to full Slack workspace access.

SKILL.md

```bash
export MATON_API_KEY="YOUR_API_KEY"
```
All requests require: `Authorization: Bearer YOUR_API_KEY`
Base URL: `https://gateway.maton.ai/slack/{method}`

Remediation: 1. Implement secure credential storage using system keychains or encrypted vaults instead of environment variables. 2. Add warnings about the security implications of using a third-party OAuth proxy. 3. Consider implementing direct Slack OAuth instead of relying on an external gateway. 4. Document the trust model clearly - users must trust maton.ai with full Slack workspace access. 5. Implement API key rotation mechanisms and document best practices.

HIGH Third-Party OAuth Proxy Creates Data Exfiltration Risk Data Exfiltrationllm

The skill routes all Slack API requests through a third-party gateway (gateway.maton.ai) that 'automatically injects your OAuth token'. This architecture means all Slack workspace data (messages, channels, users, files) flows through an external service controlled by maton.ai. Users have no visibility into what data the gateway logs, stores, or transmits. The gateway has persistent access to OAuth tokens and can perform any Slack API operation on behalf of the user. This creates significant data exfiltration and privacy risks, especially for enterprise Slack workspaces containing sensitive business communications.

SKILL.md

Base URL: `https://gateway.maton.ai/slack/{method}`
'The gateway proxies requests to slack.com and automatically injects your OAuth token.'
All API calls go through: POST 'https://gateway.maton.ai/slack/api/chat.postMessage'

Remediation: 1. Implement direct Slack OAuth without third-party proxies for production use. 2. Add prominent security warnings about data flowing through external services. 3. Document what data maton.ai collects, stores, and how long it's retained. 4. Provide alternative implementation using direct Slack API with user-managed OAuth. 5. Implement end-to-end encryption if proxy architecture is required. 6. Add audit logging of all gateway requests.

MEDIUM Misleading Skill Description Omits Third-Party Dependency Social Engineeringllm

The skill description states 'Slack API integration with managed OAuth' but fails to clearly disclose that this is not a direct Slack integration. Instead, all API requests are proxied through a third-party service (maton.ai) that manages OAuth tokens on behalf of users. The description makes it sound like a standard Slack integration, but the architecture introduces significant trust assumptions and security implications that are not apparent from the description alone. Users may not realize they're granting a third party full access to their Slack workspace.

SKILL.md

Description: 'Slack API integration with managed OAuth. Send messages, manage channels, search conversations, and interact with Slack workspaces.'
Actual implementation: All requests proxied through https://gateway.maton.ai with third-party OAuth token management

Remediation: 1. Update description to clearly state: 'Third-party Slack API proxy via maton.ai gateway with managed OAuth'. 2. Add prominent disclaimer about data flowing through external services. 3. Document the trust model and security implications upfront. 4. Provide comparison with direct Slack OAuth approach. 5. Add section on data privacy and third-party access.

MEDIUM Missing Referenced Script File Creates Tool Execution Risk Unauthorized Tool Usellm

The skill instructions reference a file 'Slack.py' that is not found in the package. This creates ambiguity about how the skill is intended to be used. If users attempt to locate or create this missing file, they may introduce security vulnerabilities. The missing file could also indicate incomplete packaging, supply chain issues, or that the skill relies on external dependencies not included in the package. Without the actual implementation, it's impossible to verify what operations the Python script performs or whether it properly validates inputs.

Referenced Files: Slack.py (not found)
No script files found in package, but instructions reference Python implementation

Remediation: 1. Include all referenced files in the skill package. 2. If Slack.py is optional, document this clearly and explain when it's needed. 3. If the skill is documentation-only (no scripts), update the description to clarify this. 4. Provide the complete implementation or remove references to missing files. 5. Add integrity checks to verify all required files are present.

What is in the package

File	Kind	Size
`LICENSE.txt`	doc	1.0 KB
`SKILL.md`	doc	7.0 KB

External hosts referenced

api.slack.com ctrl.maton.ai gateway.maton.ai maton.ai connect.maton.ai docs.slack.dev

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

MATON_API_KEY

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/slack-api
Raw scan result: slack-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-slack.svg)
Request a re-scan

Second scanner: NVIDIA SkillSpector

What this skill does

Findings

What is in the package

External hosts referenced

Environment variables referenced

What we checked

What we did not check

Sources

Related skills