{"data":{"skill":{"slug":"caffeinelabs-connector-slack","name":"connector-slack","icon":"📦","repo":"https://github.com/caffeinelabs/skills/tree/4e4462a8296d6300944d55b17feb67bc34ea9508/skills/connector-slack","status":"approved","author":"caffeinelabs","authorVersion":"0.0.3","skillstoreRevision":1},"audit":{"id":"a2004d19-00a2-47bd-afce-bb26233d3805","skill_id":"24a537fa-45df-42ab-b229-fb352038292e","version":1,"content_hash":"v3:7fd79e91da5a0cc369dfba10b3e8ca2534c9aff8:534d74cf057ccf3455070e84147fb9a38c500f03c8d2ded5a83127669543d340:4ba6c8c540d4ce3ef92db1230e81b25be2f401d1a1bcbc1bdbab153ba8add8c4:736b696c6c732f6361666665696e656c6162732f636f6e6e6563746f722d736c61636b:dc4b0c7c46cd1d9bf6461a28837aa344","risk_level":"high","is_blocked":false,"safe_to_publish":false,"analysis_status":"ok","agent_auto_install_policy":"confirmation_required","manual_install_policy":"allowed","summary":"All 65 external-command alerts are false positives caused by Markdown backticks and code fences; no Ruby or shell backtick execution exists. The three hardcoded URLs point to official Slack properties and match the connector's declared purpose. The example exposes posting to every authenticated caller, enabling unauthorized Slack messages under the configured workspace credential.","remediation":[{"issue":"The postSlackMessage example permits every non-anonymous caller to send messages with the shared Slack credential.","severity":"high","suggestion":"Require an explicit sender permission before posting, restrict allowed channels, validate message limits, and add rate controls."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":5,"line_start":5},{"file":"SKILL.md","line_end":8,"line_start":8},{"file":"SKILL.md","line_end":11,"line_start":11},{"file":"SKILL.md","line_end":26,"line_start":26},{"file":"SKILL.md","line_end":27,"line_start":27},{"file":"SKILL.md","line_end":29,"line_start":29},{"file":"SKILL.md","line_end":30,"line_start":30},{"file":"SKILL.md","line_end":31,"line_start":31},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":54,"line_start":54},{"file":"SKILL.md","line_end":57,"line_start":57},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":71,"line_start":71},{"file":"SKILL.md","line_end":74,"line_start":74},{"file":"SKILL.md","line_end":78,"line_start":78},{"file":"SKILL.md","line_end":79,"line_start":79},{"file":"SKILL.md","line_end":81,"line_start":81},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":85,"line_start":85},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":91,"line_start":91},{"file":"SKILL.md","line_end":93,"line_start":93},{"file":"SKILL.md","line_end":94,"line_start":94},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":110,"line_start":110},{"file":"SKILL.md","line_end":113,"line_start":113},{"file":"SKILL.md","line_end":114,"line_start":114},{"file":"SKILL.md","line_end":117,"line_start":117},{"file":"SKILL.md","line_end":119,"line_start":119},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":139,"line_start":136},{"file":"SKILL.md","line_end":142,"line_start":139},{"file":"SKILL.md","line_end":144,"line_start":144},{"file":"SKILL.md","line_end":149,"line_start":146},{"file":"SKILL.md","line_end":159,"line_start":149},{"file":"SKILL.md","line_end":159,"line_start":159},{"file":"SKILL.md","line_end":166,"line_start":164},{"file":"SKILL.md","line_end":178,"line_start":166},{"file":"SKILL.md","line_end":188,"line_start":178},{"file":"SKILL.md","line_end":190,"line_start":188},{"file":"SKILL.md","line_end":207,"line_start":190}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":76,"line_start":76},{"file":"SKILL.md","line_end":249,"line_start":249}]}],"critical_findings":[],"high_findings":[{"title":"Slack Posting Lacks Role Authorization","locations":[{"file":"SKILL.md","line_end":215,"line_start":209}],"confidence":0.98,"description":"The example rejects anonymous callers but lets every authenticated caller post arbitrary text through the shared bot or user credential.","review_kind":"security","source_category":"semantic","source_severity":"high","confidence_reasoning":"Lines 209-215 check only caller anonymity before using the shared Slack token; no role, channel, or message authorization is enforced."}],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":1,"total_lines":259,"audit_model":"codex","audited_at":"2026-08-19T08:30:43.114+00:00","created_at":"2026-08-19T10:10:11.580186+00:00","static_findings":[{"id":"external_commands:SKILL.md:5:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Caffeine canister via the `slack-client` mops package (Slack Web API). Use it","category":"external_commands","line_end":5,"severity":"medium","line_start":5},{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"is a pre-release 0.0.3 drop (bot `xoxb-` or user `xoxp-` token): its request path is verified agains","category":"external_commands","line_end":8,"severity":"medium","line_start":8},{"id":"external_commands:SKILL.md:11:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"a fully supported platform feature yet. Hand-rolling `ic.http_request` calls to `slack.com/api` is s","category":"external_commands","line_end":11,"severity":"medium","line_start":11},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> ⚠️ **Experimental (`slack-client@0.0.3`).** The request path is fixed and","category":"external_commands","line_end":26,"severity":"medium","line_start":26},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> verified — a real `chat.postMessage` posts successfully against the live Slack","category":"external_commands","line_end":27,"severity":"medium","line_start":27},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> `application/x-www-form-urlencoded` body). NOT yet runtime-verified: the","category":"external_commands","line_end":29,"severity":"medium","line_start":29},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> success-response decode (`{\"ok\":true,...}` → the success schema) and the","category":"external_commands","line_end":30,"severity":"medium","line_start":30},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> `{\"ok\":false}` error envelope (see *Known limitations*). Treat as pre-release;","category":"external_commands","line_end":31,"severity":"medium","line_start":31},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"channel, or notifying a Slack workspace. The generated `slack-client` package is","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"the preferred path; raw `ic.http_request` to `https://slack.com/api/*` is an","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Post a message to a Slack channel as the app | `slack-client` `chatPostMessage` with a bot token (","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| Post to Slack *as a named person* | `slack-client` `chatPostMessage` with a user token (`xoxp-`) |","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Scope of this generated drop: the messaging-core families `chat`,","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`conversations`, `users`, `files`, `reactions`, and `pins` (10 API modules).","category":"external_commands","line_end":54,"severity":"medium","line_start":54},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"## Auth model — bot token (`xoxb-`) or user token (`xoxp-`)","category":"external_commands","line_end":57,"severity":"medium","line_start":57},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **the app itself** (posts show the app's name with an `APP` badge) | **`xoxb-`** *(default — prefe","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"| **a specific person** (posts show that human's name and avatar) | **`xoxp-`** | Every action is at","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"If the request is \"post notifications/alerts from my app\", that is `xoxb-`. Only","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"choose `xoxp-` when the user explicitly wants messages to look like they came","category":"external_commands","line_end":71,"severity":"medium","line_start":71},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Obtaining a bot token (`xoxb-`)","category":"external_commands","line_end":74,"severity":"medium","line_start":74},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. **OAuth & Permissions** → *Scopes* → **Bot Token Scopes**: add `chat:write`","category":"external_commands","line_end":78,"severity":"medium","line_start":78},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"(plus `channels:read`, `reactions:write`, ... only as needed).","category":"external_commands","line_end":79,"severity":"medium","line_start":79},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"which starts with `xoxb-`.","category":"external_commands","line_end":81,"severity":"medium","line_start":81},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. In Slack, invite the app to each target channel: `/invite @YourApp`. Skipping","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"this is the most common first failure (`not_in_channel`).","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"### Obtaining a user token (`xoxp-`)","category":"external_commands","line_end":85,"severity":"medium","line_start":85},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"*separate* list from bot scopes): add e.g. `chat:write`, `search:read`.","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. Copy the **User OAuth Token**, which starts with `xoxp-`.","category":"external_commands","line_end":91,"severity":"medium","line_start":91},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"A single admin-supplied `xoxp-` is supported by this recipe: it goes through the","category":"external_commands","line_end":93,"severity":"medium","line_start":93},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"same setter and the same `config.auth`. What is **out of scope** here is per-user","category":"external_commands","line_end":94,"severity":"medium","line_start":94},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`AccessControl.hasPermission(state, caller, #admin)`. The token is held by the","category":"external_commands","line_end":103,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> `caller == owner` check and can overwrite the workspace token. Use the","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"> authorization component's `#admin` permission, as the example below does.","category":"external_commands","line_end":110,"severity":"medium","line_start":110},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`config.auth = ?#bearer(token)`, which every method turns into an","category":"external_commands","line_end":113,"severity":"medium","line_start":113},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`Authorization: Bearer ...` header. No method takes a token argument and no method","category":"external_commands","line_end":114,"severity":"medium","line_start":114},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"## `is_replicated = ?false` is REQUIRED","category":"external_commands","line_end":117,"severity":"medium","line_start":117},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"Every Slack outcall must set `is_replicated = ?false` on its `Config`:","category":"external_commands","line_end":119,"severity":"medium","line_start":119},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"subnet, each carrying the `Authorization: Bearer xoxb-...`/`xoxp-...` header — a leak from","category":"external_commands","line_end":122,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. **Determinism.** Slack responses carry per-request fields (message `ts`), so","category":"external_commands","line_end":126,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```bash","category":"external_commands","line_end":139,"severity":"medium","line_start":136},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":142,"severity":"medium","line_start":139},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"unfurlLinks, unfurlMedia, username)`. Pass empty strings / `false` for the","category":"external_commands","line_end":144,"severity":"medium","line_start":144},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`config.auth` (see *Auth model* above); this holds for every method in the","category":"external_commands","line_end":149,"severity":"medium","line_start":146},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```motoko filepath=src/backend/main.mo","category":"external_commands","line_end":159,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"// Admin-held Slack token, `xoxb-...` or `xoxp-...` — never returned to the frontend.","category":"external_commands","line_end":159,"severity":"medium","line_start":159},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":166,"severity":"medium","line_start":164},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```motoko filepath=src/backend/mixins/slack-config.mo","category":"external_commands","line_end":178,"severity":"medium","line_start":166},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"// Admin-only; accepts either token flavour. NOTE: `#admin` — never a","category":"external_commands","line_end":188,"severity":"medium","line_start":178},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":190,"severity":"medium","line_start":188},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```motoko filepath=src/backend/mixins/slack-messaging.mo","category":"external_commands","line_end":207,"severity":"medium","line_start":190},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"// Post `text` to `channel` (channel ID like \"C012AB3CD\" or \"#general\").","category":"external_commands","line_end":207,"severity":"medium","line_start":207},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"// Returns the posted message timestamp (`ts`).","category":"external_commands","line_end":231,"severity":"medium","line_start":208},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":235,"severity":"medium","line_start":231},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **`{\"ok\": false}` envelope.** Slack signals logical failures (bad token,","category":"external_commands","line_end":236,"severity":"medium","line_start":235},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"missing scope, channel not found) as `{\"ok\": false, \"error\": \"...\"}` over HTTP","category":"external_commands","line_end":238,"severity":"medium","line_start":236},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"convert into the success schema, so the call **rejects** (`Error.reject`, i.e. a","category":"external_commands","line_end":239,"severity":"medium","line_start":238},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"failed `await`) instead of returning a value. Handle it as a rejected call —","category":"external_commands","line_end":240,"severity":"medium","line_start":239},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`try { ... } catch (e) { Error.message(e) }`; with `diagnostics` on that message","category":"external_commands","line_end":240,"severity":"medium","line_start":240},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"carries the raw Slack body, including Slack's `error` string. Do **not** write","category":"external_commands","line_end":242,"severity":"medium","line_start":241},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`if (res.ok) ...`: a returned value has already decoded, so `ok` is always","category":"external_commands","line_end":242,"severity":"medium","line_start":242},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`true` there and the check is dead code. A `responseEnvelope`/`okEnvelope`","category":"external_commands","line_end":243,"severity":"medium","line_start":243},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- **Reachability (IPv4) — no proxy needed.** `slack.com` is IPv4-only, which used","category":"external_commands","line_end":248,"severity":"medium","line_start":245},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"proxy when that fails, so IPv4-only hosts work: leave `config.baseUrl` at the","category":"external_commands","line_end":249,"severity":"medium","line_start":248},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"default `https://slack.com/api`. The TLS session is end-to-end between node and","category":"external_commands","line_end":253,"severity":"medium","line_start":249},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"`Authorization: Bearer` header only — never in the URL, so it cannot land in a","category":"external_commands","line_end":257,"severity":"medium","line_start":253},{"id":"network:SKILL.md:38:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"the preferred path; raw `ic.http_request` to `https://slack.com/api/*` is an","category":"network","line_end":38,"severity":"low","line_start":38},{"id":"network:SKILL.md:76:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"1. <https://api.slack.com/apps> → **Create New App** → *From scratch*, pick the","category":"network","line_end":76,"severity":"low","line_start":76},{"id":"network:SKILL.md:249:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"default `https://slack.com/api`. The TLS session is end-to-end between node and","category":"network","line_end":249,"severity":"low","line_start":249}],"finding_verdicts":[{"id":"external_commands:SKILL.md:5:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:8:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:11:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:26:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:27:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:29:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:30:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:31:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:54:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:57:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:71:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:74:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:78:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:79:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:81:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:85:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:91:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:93:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:94:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:110:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:113:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:114:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:117:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:119:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:136:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:139:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:144:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:146:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:159:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:164:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:166:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:178:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:188:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:190:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:207:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:208:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:231:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:235:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:236:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:238:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:239:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:240:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:241:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:242:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:243:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:245:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:248:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:249:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:253:ruby-shell-backtick-execution","reason":"The match is Markdown inline notation or a fenced example, not Ruby or shell command substitution. No executable backtick expression appears.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:38:hardcoded-url","reason":"This is a documentation reference to Slack's official API and explicitly discourages raw requests. The destination matches the connector's declared purpose.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:76:hardcoded-url","reason":"This link directs administrators to Slack's official application setup page. It does not transmit credentials or invoke an unexpected service.","verdict":"false_positive","confidence":0.98},{"id":"network:SKILL.md:249:hardcoded-url","reason":"This is the slack-client default endpoint on Slack's official HTTPS domain. The documented bearer credential is sent only to the intended provider.","verdict":"false_positive","confidence":0.98}],"semantic_findings":[{"title":"Slack Posting Lacks Role Authorization","severity":"high","locations":[{"file":"SKILL.md","line_end":215,"line_start":209}],"confidence":0.98,"description":"The example rejects anonymous callers but lets every authenticated caller post arbitrary text through the shared bot or user credential.","confidence_reasoning":"Lines 209-215 check only caller anonymity before using the shared Slack token; no role, channel, or message authorization is enforced."}],"subject_marketplace_commit_sha":"7fd79e91da5a0cc369dfba10b3e8ca2534c9aff8","subject_content_hash":"534d74cf057ccf3455070e84147fb9a38c500f03c8d2ded5a83127669543d340","subject_tree_hash":"4ba6c8c540d4ce3ef92db1230e81b25be2f401d1a1bcbc1bdbab153ba8add8c4","subject_plugin_path":"skills/caffeinelabs/connector-slack","audit_payload_hash":"dc4b0c7c46cd1d9bf6461a28837aa344","confirmed_risk_level":"high","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"7fd79e91da5a0cc369dfba10b3e8ca2534c9aff8","contentHash":"534d74cf057ccf3455070e84147fb9a38c500f03c8d2ded5a83127669543d340","treeHash":"4ba6c8c540d4ce3ef92db1230e81b25be2f401d1a1bcbc1bdbab153ba8add8c4","pluginPath":"skills/caffeinelabs/connector-slack","auditPayloadHash":"dc4b0c7c46cd1d9bf6461a28837aa344"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/caffeinelabs-connector-slack/audits/1/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"high","confirmedFindingCount":1,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"confirmation_required","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}