📦

connector-slack

Name: connector-slack
Author: caffeinelabs

v0.0.3 Révision du contenu r1 Risque élevé ⚙️ Commandes externes🌐 Accès réseau

Connect Caffeine Canisters to Slack

Caffeine canisters need secure Slack messaging without custom HTTP and authentication code. This skill provides an experimental client setup, token guidance, and Motoko examples.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "connector-slack" from https://skillstore.io/skills/caffeinelabs-connector-slack.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-connector-slack/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/caffeinelabs-connector-slack.md manifest signé GET /api/skills/caffeinelabs-connector-slack/manifest lockfile signé GET /api/skills/caffeinelabs-connector-slack/lockfile

Tester

Utilisation de « connector-slack ». Post deployment alerts to the engineering channel as the application.

Résultat attendu:

Selected a bot token because messages should represent the application.
Required scope: chat:write.
Invite the Slack app to the engineering channel before testing.

Utilisation de « connector-slack ». Allow support leads to send approved incident updates to two Slack channels.

Résultat attendu:

Store the token through the administrator-only setter.
Require the support-lead permission before each post.
Allow only the two approved channel identifiers and apply rate limits.

Utilisation de « connector-slack ». Assess whether this connector is ready for production.

Résultat attendu:

The connector remains experimental. Verify response decoding, add sender authorization, test Slack error handling, rotate secrets, and monitor rate limits before production use.

Audit de sécurité

Risque élevé

v1 • 19/08/2026 Ouvrir le rapport versionné

All 65 external-command alerts are false positives caused by Markdown backticks and code fences; no Ruby or shell backtick execution exists. The three hardcoded URLs point to official Slack properties and match the connector's declared purpose. The example exposes posting to every authenticated caller, enabling unauthorized Slack messages under the configured workspace credential.

Fichiers analysés

259

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Élevé

SKILL.md:209-215

Slack Posting Lacks Role Authorization

The example rejects anonymous callers but lets every authenticated caller post arbitrary text through the shared bot or user credential.

Lines 209-215 check only caller anonymity before using the shared Slack token; no role, channel, or message authorization is enforced.

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-connector-slack/security.svg)](https://skillstore.io/skills/caffeinelabs-connector-slack?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/caffeinelabs-connector-slack?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-connector-slack/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-connector-slack.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

caffeinelabs. (2026). connector-slack security audit report (audit version 1) [Author version 0.0.3]. Skillstore. https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1

Citation BibTeX

@techreport{caffeinelabs-caffeinelabs-connector-slack-2026,
  author = {caffeinelabs},
  title = {connector-slack security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1},
  note = {Author version 0.0.3}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "connector-slack security audit report (audit version 1)"
version: "0.0.3"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-08-19"
url: "https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-connector-slack:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Add Application Alerts

Send operational notifications from a Caffeine application to a designated Slack channel.

Secure Workspace Setup

Configure a workspace token, minimal scopes, channel membership, and administrator-only secret updates.

Prototype Slack Workflows

Test bot or user message identity before committing to a production integration.

Essayez ces prompts

Post a Basic Notification

Add Slack notifications to my Caffeine canister. Use a bot token and post [message] to [channel]. Explain the required setup.

Choose the Token Model

Compare bot and user tokens for [workflow]. Recommend one, list required Slack scopes, and explain identity and channel access consequences.

Secure Slack Configuration

Implement administrator-only Slack token configuration and authenticated posting. Restrict senders to [role], allow [channels], and avoid exposing the token.

Design a Resilient Integration

Design a production hardening plan for this experimental connector. Cover authorization, rate limits, retries, response decoding, observability, secret rotation, and tests.

Bonnes pratiques

Prefer bot tokens unless a workflow explicitly requires a person's Slack identity.
Grant only required Slack scopes and limit posting to approved channels.
Protect token updates and message posting with separate role permissions.

Éviter

Do not expose Slack tokens to the frontend, logs, URLs, or generated output.
Do not permit every authenticated caller to post with a shared workspace credential.
Do not present the pre-release connector as production-ready without runtime tests.

Foire aux questions

Which Slack token should I use?

Use a bot token for application messages. Use a user token only when the message must represent a specific person.

Which Slack scope is required for posting?

The basic posting flow requires chat:write. Add other scopes only when the selected API method requires them.

Must the Slack app join the channel?

A bot must usually be invited to each target channel. User tokens inherit the authorized person's channel access.

Does the skill support per-user OAuth?

No. It supports one administrator-supplied bot or user token and does not implement OAuth redirects, exchanges, or refreshes.

Is this connector production-ready?

No. Version 0.0.3 is experimental, and success and error response decoding still need complete runtime verification.

How should posting access be protected?

Require an explicit application role, restrict allowed channels, validate message size, and apply rate controls before using the shared credential.

Détails du développeur

Auteur

caffeinelabs

Licence

MIT

Version de l’auteur

v0.0.3

Révision Skillstore

Dépôt

https://github.com/caffeinelabs/skills/tree/4e4462a8296d6300944d55b17feb67bc34ea9508/skills/connector-slack

Réf

7fd79e91da5a0cc369dfba10b3e8ca2534c9aff8

Récence de maintenance

19/08/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📄 SKILL.md

connector-slack

Installer avec mon Agent

Ressources lisibles par les agents

Tester

Audit de sécurité

Préoccupations de sécurité confirmées (1)

Facteurs de risque

Copier le lien du rapport

Badge Markdown

Badge HTML

Carte intégrable

Citation APA

Citation BibTeX

CITATION.cff

Score Skillstore

Ce que vous pouvez créer

Add Application Alerts

Secure Workspace Setup

Prototype Slack Workflows

Essayez ces prompts

Bonnes pratiques

Éviter

Foire aux questions

Détails du développeur