Habilidades connector-slack

📦

connector-slack

Name: connector-slack
Author: caffeinelabs

v0.0.3 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red

Connect Caffeine Canisters to Slack

Caffeine canisters need secure Slack messaging without custom HTTP and authentication code. This skill provides an experimental client setup, token guidance, and Motoko examples.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "connector-slack" from https://skillstore.io/skills/caffeinelabs-connector-slack.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-connector-slack/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/caffeinelabs-connector-slack.md Manifest firmado GET /api/skills/caffeinelabs-connector-slack/manifest Lockfile firmado GET /api/skills/caffeinelabs-connector-slack/lockfile

Pruébalo

Usando "connector-slack". Post deployment alerts to the engineering channel as the application.

Resultado esperado:

Selected a bot token because messages should represent the application.
Required scope: chat:write.
Invite the Slack app to the engineering channel before testing.

Usando "connector-slack". Allow support leads to send approved incident updates to two Slack channels.

Resultado esperado:

Store the token through the administrator-only setter.
Require the support-lead permission before each post.
Allow only the two approved channel identifiers and apply rate limits.

Usando "connector-slack". Assess whether this connector is ready for production.

Resultado esperado:

The connector remains experimental. Verify response decoding, add sender authorization, test Slack error handling, rotate secrets, and monitor rate limits before production use.

Auditoría de seguridad

Riesgo alto

v1 • 19/8/2026 Abrir el informe versionado

All 65 external-command alerts are false positives caused by Markdown backticks and code fences; no Ruby or shell backtick execution exists. The three hardcoded URLs point to official Slack properties and match the connector's declared purpose. The example exposes posting to every authenticated caller, enabling unauthorized Slack messages under the configured workspace credential.

Archivos escaneados

259

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Alto

SKILL.md:209-215

Slack Posting Lacks Role Authorization

The example rejects anonymous callers but lets every authenticated caller post arbitrary text through the shared bot or user credential.

Lines 209-215 check only caller anonymity before using the shared Slack token; no role, channel, or message authorization is enforced.

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-connector-slack/security.svg)](https://skillstore.io/skills/caffeinelabs-connector-slack?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/caffeinelabs-connector-slack?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-connector-slack/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-connector-slack.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

caffeinelabs. (2026). connector-slack security audit report (audit version 1) [Author version 0.0.3]. Skillstore. https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1

Cita BibTeX

@techreport{caffeinelabs-caffeinelabs-connector-slack-2026,
  author = {caffeinelabs},
  title = {connector-slack security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1},
  note = {Author version 0.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "connector-slack security audit report (audit version 1)"
version: "0.0.3"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-08-19"
url: "https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-connector-slack:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Add Application Alerts

Send operational notifications from a Caffeine application to a designated Slack channel.

Secure Workspace Setup

Configure a workspace token, minimal scopes, channel membership, and administrator-only secret updates.

Prototype Slack Workflows

Test bot or user message identity before committing to a production integration.

Prueba estos prompts

Post a Basic Notification

Add Slack notifications to my Caffeine canister. Use a bot token and post [message] to [channel]. Explain the required setup.

Choose the Token Model

Compare bot and user tokens for [workflow]. Recommend one, list required Slack scopes, and explain identity and channel access consequences.

Secure Slack Configuration

Implement administrator-only Slack token configuration and authenticated posting. Restrict senders to [role], allow [channels], and avoid exposing the token.

Design a Resilient Integration

Design a production hardening plan for this experimental connector. Cover authorization, rate limits, retries, response decoding, observability, secret rotation, and tests.

Mejores prácticas

Prefer bot tokens unless a workflow explicitly requires a person's Slack identity.
Grant only required Slack scopes and limit posting to approved channels.
Protect token updates and message posting with separate role permissions.

Evitar

Do not expose Slack tokens to the frontend, logs, URLs, or generated output.
Do not permit every authenticated caller to post with a shared workspace credential.
Do not present the pre-release connector as production-ready without runtime tests.

Preguntas frecuentes

Which Slack token should I use?

Use a bot token for application messages. Use a user token only when the message must represent a specific person.

Which Slack scope is required for posting?

The basic posting flow requires chat:write. Add other scopes only when the selected API method requires them.

Must the Slack app join the channel?

A bot must usually be invited to each target channel. User tokens inherit the authorized person's channel access.

Does the skill support per-user OAuth?

No. It supports one administrator-supplied bot or user token and does not implement OAuth redirects, exchanges, or refreshes.

Is this connector production-ready?

No. Version 0.0.3 is experimental, and success and error response decoding still need complete runtime verification.

How should posting access be protected?

Require an explicit application role, restrict allowed channels, validate message size, and apply rate controls before using the shared credential.

Detalles del desarrollador

Autor

caffeinelabs

Licencia

MIT

Versión del autor

v0.0.3

Revisión de Skillstore

Repositorio

https://github.com/caffeinelabs/skills/tree/4e4462a8296d6300944d55b17feb67bc34ea9508/skills/connector-slack

Ref.

7fd79e91da5a0cc369dfba10b3e8ca2534c9aff8

Actualidad del mantenimiento

19/8/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md

connector-slack

Instalar con mi Agente

Recursos legibles por agentes

Pruébalo

Auditoría de seguridad

Preocupaciones de seguridad confirmadas (1)

Factores de riesgo

Copiar enlace del informe

Insignia Markdown

Insignia HTML

Tarjeta para insertar

Cita APA

Cita BibTeX

CITATION.cff

Puntuación de Skillstore

Lo que puedes crear

Add Application Alerts

Secure Workspace Setup

Prototype Slack Workflows

Prueba estos prompts

Mejores prácticas

Evitar

Preguntas frecuentes

Detalles del desarrollador