📦

connector-slack

Name: connector-slack
Author: caffeinelabs

v0.0.3 مراجعة المحتوى r1 مخاطر عالية ⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة

Connect Caffeine Canisters to Slack

Caffeine canisters need secure Slack messaging without custom HTTP and authentication code. This skill provides an experimental client setup, token guidance, and Motoko examples.

يدعم: Claude Codex Code(CC)

⚠️ 38 ضعيف

توقف واطلب التأكيد قبل التثبيت.

راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "connector-slack" from https://skillstore.io/skills/caffeinelabs-connector-slack.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-connector-slack/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/caffeinelabs-connector-slack.md manifest موقَّع GET /api/skills/caffeinelabs-connector-slack/manifest lockfile موقَّع GET /api/skills/caffeinelabs-connector-slack/lockfile

اختبرها

جارٍ استخدام "connector-slack". Post deployment alerts to the engineering channel as the application.

النتيجة المتوقعة:

Selected a bot token because messages should represent the application.
Required scope: chat:write.
Invite the Slack app to the engineering channel before testing.

جارٍ استخدام "connector-slack". Allow support leads to send approved incident updates to two Slack channels.

النتيجة المتوقعة:

Store the token through the administrator-only setter.
Require the support-lead permission before each post.
Allow only the two approved channel identifiers and apply rate limits.

جارٍ استخدام "connector-slack". Assess whether this connector is ready for production.

النتيجة المتوقعة:

The connector remains experimental. Verify response decoding, add sender authorization, test Slack error handling, rotate secrets, and monitor rate limits before production use.

التدقيق الأمني

مخاطر عالية

v1 • ١٩‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

All 65 external-command alerts are false positives caused by Markdown backticks and code fences; no Ruby or shell backtick execution exists. The three hardcoded URLs point to official Slack properties and match the connector's declared purpose. The example exposes posting to every authenticated caller, enabling unauthorized Slack messages under the configured workspace credential.

الملفات التي تم فحصها

259

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (1)

مرتفع

SKILL.md:209-215

Slack Posting Lacks Role Authorization

The example rejects anonymous callers but lets every authenticated caller post arbitrary text through the shared bot or user credential.

Lines 209-215 check only caller anonymity before using the shared Slack token; no role, channel, or message authorization is enforced.

عوامل الخطر

دقّقه: codex

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-connector-slack/security.svg)](https://skillstore.io/skills/caffeinelabs-connector-slack?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/caffeinelabs-connector-slack?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-connector-slack/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-connector-slack.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

caffeinelabs. (2026). connector-slack security audit report (audit version 1) [Author version 0.0.3]. Skillstore. https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1

اقتباس BibTeX

@techreport{caffeinelabs-caffeinelabs-connector-slack-2026,
  author = {caffeinelabs},
  title = {connector-slack security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1},
  note = {Author version 0.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "connector-slack security audit report (audit version 1)"
version: "0.0.3"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-08-19"
url: "https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-connector-slack:audit:1"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: متوسط

الهندسة المعمارية

100

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Add Application Alerts

Send operational notifications from a Caffeine application to a designated Slack channel.

Secure Workspace Setup

Configure a workspace token, minimal scopes, channel membership, and administrator-only secret updates.

Prototype Slack Workflows

Test bot or user message identity before committing to a production integration.

جرّب هذه الموجّهات

Post a Basic Notification

Add Slack notifications to my Caffeine canister. Use a bot token and post [message] to [channel]. Explain the required setup.

Choose the Token Model

Compare bot and user tokens for [workflow]. Recommend one, list required Slack scopes, and explain identity and channel access consequences.

Secure Slack Configuration

Implement administrator-only Slack token configuration and authenticated posting. Restrict senders to [role], allow [channels], and avoid exposing the token.

Design a Resilient Integration

Design a production hardening plan for this experimental connector. Cover authorization, rate limits, retries, response decoding, observability, secret rotation, and tests.

أفضل الممارسات

Prefer bot tokens unless a workflow explicitly requires a person's Slack identity.
Grant only required Slack scopes and limit posting to approved channels.
Protect token updates and message posting with separate role permissions.

تجنب

Do not expose Slack tokens to the frontend, logs, URLs, or generated output.
Do not permit every authenticated caller to post with a shared workspace credential.
Do not present the pre-release connector as production-ready without runtime tests.

الأسئلة المتكررة

Which Slack token should I use?

Use a bot token for application messages. Use a user token only when the message must represent a specific person.

Which Slack scope is required for posting?

The basic posting flow requires chat:write. Add other scopes only when the selected API method requires them.

Must the Slack app join the channel?

A bot must usually be invited to each target channel. User tokens inherit the authorized person's channel access.

Does the skill support per-user OAuth?

No. It supports one administrator-supplied bot or user token and does not implement OAuth redirects, exchanges, or refreshes.

Is this connector production-ready?

No. Version 0.0.3 is experimental, and success and error response decoding still need complete runtime verification.

How should posting access be protected?

Require an explicit application role, restrict allowed channels, validate message size, and apply rate controls before using the shared credential.

تفاصيل المطور

المؤلف

caffeinelabs

الترخيص

MIT

إصدار المؤلف

v0.0.3

مراجعة Skillstore

المستودع

https://github.com/caffeinelabs/skills/tree/4e4462a8296d6300944d55b17feb67bc34ea9508/skills/connector-slack

مرجع

7fd79e91da5a0cc369dfba10b3e8ca2534c9aff8

حداثة الصيانة

١٩‏/٨‏/٢٠٢٦

الاستخدام

0 تنزيلات · 0 مشاهدات

بنية الملفات

📄 SKILL.md