📦

slack

Name: slack
Author: vercel-labs

Content revision r1 Medium Risk 🌐 Network access⚙️ External commands

Automate Slack Workspace Tasks

Slack work often requires manual checks across channels, DMs, search results, and threads. This skill guides Claude, Codex, or Claude Code through browser-based Slack navigation and scoped evidence capture.

Supports: Claude Codex Code(CC)

📊 67 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "slack" from https://skillstore.io/skills/vercel-labs-slack.md and its manifest at https://skillstore.io/api/skills/vercel-labs-slack/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/vercel-labs-slack.md Signed manifest GET /api/skills/vercel-labs-slack/manifest Signed lockfile GET /api/skills/vercel-labs-slack/lockfile

Test it

Using "slack". Check my unread Slack activity for work planning.

Expected outcome:

Unread activity appears in #engineering and #launch.
Two DMs show unread badges, but their contents were not opened.
Local screenshots were captured for your review.

Using "slack". Find messages about the deployment issue in the engineering channel.

Expected outcome:

Several matching messages mention deployment errors and rollback timing.
The main thread includes a proposed fix, owner, and follow-up time.
The summary includes senders, visible timestamps, and channel context.

Using "slack". Create a handoff summary from the approved incident channels.

Expected outcome:

The report groups findings by channel and topic.
Each item includes visible message context and a recommended follow-up.
Sensitive content is summarized instead of copied in full.

Security Audit

Medium Risk

v6 • 7/9/2026 Open versioned report

Most static alerts are false positives caused by Markdown code fences, inline element references, Slack URLs, and fixed agent-browser examples. One low-severity workspace-specific Slack URL should be sanitized, and the main residual risk is privacy exposure from reading messages and saving Slack screenshots.

Files scanned

799

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:182-201 references/slack-tasks.md:177-209

Sensitive Slack Data Collection

The skill instructs agents to read Slack conversations, extract user, message, timestamp, and reaction details, and capture screenshots. This is legitimate for scoped Slack automation but can expose confidential workspace communications if run too broadly.

The source explicitly documents Slack data extraction fields and screenshot capture around user conversations. There is no external exfiltration endpoint, so the concern is scoped privacy exposure rather than malware behavior.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Low

references/slack-tasks.md:282

Hardcoded URL

- /url: https://vercel.slack.com/archives/C0A5RTN0856/p1772036782543189

The reference includes a concrete vercel.slack.com archive URL with channel and message identifiers. It is not an active exfiltration path, but it may disclose workspace metadata if copied from a real Slack instance.

Risk Factors

🌐 Network access (4)

references/slack-tasks.md:282 SKILL.md:20 SKILL.md:283 SKILL.md:284

⚙️ External commands (46)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/vercel-labs-slack/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/vercel-labs-slack/security.svg)](https://skillstore.io/skills/vercel-labs-slack?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/vercel-labs-slack?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vercel-labs-slack/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/vercel-labs-slack.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

vercel-labs. (2026). slack security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vercel-labs-slack/audits/6

BibTeX citation

@techreport{vercel-labs-vercel-labs-slack-2026,
  author = {vercel-labs},
  title = {slack security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/vercel-labs-slack/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "slack security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "vercel-labs"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/vercel-labs-slack/audits/6"
identifiers:
  - type: other
    value: "skillstore:vercel-labs-slack:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review unread activity

Summarize unread channels and DMs before a team lead starts daily triage.

Find incident messages

Search channel history for incident terms, senders, timestamps, and thread context.

Capture workspace status evidence

Collect scoped screenshots and visible Slack details for an operations handoff.

Try These Prompts

Check unread Slack activity

Connect to my Slack browser session, review Activity, DMs, and unread channels, then summarize unread items without opening private DMs unless I ask.

Search one channel

Search Slack for the topic I provide in the channel I name. Summarize matching messages with sender, time, channel, and useful context.

Review a thread with evidence

Open the Slack conversation I specify, inspect the relevant thread, capture a local screenshot, and summarize the decision, owner, and next step.

Create a scoped workspace report

Review the approved channels, search terms, and time window I provide. Produce a concise report of findings and list any screenshots saved locally.

Best Practices

Confirm the workspace, channels, and DMs before reading message content.
Take fresh snapshots after navigation because element references change.
Redact screenshots or message excerpts before sharing them outside the workspace.