connector-slack
Connect Caffeine Canisters to Slack
Caffeine canisters need secure Slack messaging without custom HTTP and authentication code. This skill provides an experimental client setup, token guidance, and Motoko examples.
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
Review the Skillstore skill "connector-slack" from https://skillstore.io/skills/caffeinelabs-connector-slack.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-connector-slack/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“connector-slack”。 Post deployment alerts to the engineering channel as the application.
预期结果:
- Selected a bot token because messages should represent the application.
- Required scope: chat:write.
- Invite the Slack app to the engineering channel before testing.
正在使用“connector-slack”。 Allow support leads to send approved incident updates to two Slack channels.
预期结果:
- Store the token through the administrator-only setter.
- Require the support-lead permission before each post.
- Allow only the two approved channel identifiers and apply rate limits.
正在使用“connector-slack”。 Assess whether this connector is ready for production.
预期结果:
The connector remains experimental. Verify response decoding, add sender authorization, test Slack error handling, rotate secrets, and monitor rate limits before production use.
安全审计
高风险All 65 external-command alerts are false positives caused by Markdown backticks and code fences; no Ruby or shell backtick execution exists. The three hardcoded URLs point to official Slack properties and match the connector's declared purpose. The example exposes posting to every authenticated caller, enabling unauthorized Slack messages under the configured workspace credential.
已确认安全问题 (1)
风险因素
⚙️ 外部命令 (50)
🌐 网络访问 (3)
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/caffeinelabs-connector-slack?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/caffeinelabs-connector-slack?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-connector-slack/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/caffeinelabs-connector-slack.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
caffeinelabs. (2026). connector-slack security audit report (audit version 1) [Author version 0.0.3]. Skillstore. https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1BibTeX 引用
@techreport{caffeinelabs-caffeinelabs-connector-slack-2026,
author = {caffeinelabs},
title = {connector-slack security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1},
note = {Author version 0.0.3}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "connector-slack security audit report (audit version 1)"
version: "0.0.3"
type: report
authors:
- name: "caffeinelabs"
date-released: "2026-08-19"
url: "https://skillstore.io/skills/caffeinelabs-connector-slack/audits/1"
identifiers:
- type: other
value: "skillstore:caffeinelabs-connector-slack:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中你能构建什么
Add Application Alerts
Send operational notifications from a Caffeine application to a designated Slack channel.
Secure Workspace Setup
Configure a workspace token, minimal scopes, channel membership, and administrator-only secret updates.
Prototype Slack Workflows
Test bot or user message identity before committing to a production integration.
试试这些提示
Add Slack notifications to my Caffeine canister. Use a bot token and post [message] to [channel]. Explain the required setup.
Compare bot and user tokens for [workflow]. Recommend one, list required Slack scopes, and explain identity and channel access consequences.
Implement administrator-only Slack token configuration and authenticated posting. Restrict senders to [role], allow [channels], and avoid exposing the token.
Design a production hardening plan for this experimental connector. Cover authorization, rate limits, retries, response decoding, observability, secret rotation, and tests.
最佳实践
- Prefer bot tokens unless a workflow explicitly requires a person's Slack identity.
- Grant only required Slack scopes and limit posting to approved channels.
- Protect token updates and message posting with separate role permissions.
避免
- Do not expose Slack tokens to the frontend, logs, URLs, or generated output.
- Do not permit every authenticated caller to post with a shared workspace credential.
- Do not present the pre-release connector as production-ready without runtime tests.
常见问题
Which Slack token should I use?
Which Slack scope is required for posting?
Must the Slack app join the channel?
Does the skill support per-user OAuth?
Is this connector production-ready?
How should posting access be protected?
开发者详情
作者
caffeinelabs许可证
MIT
作者版本
v0.0.3
Skillstore 修订
r1
引用
7fd79e91da5a0cc369dfba10b3e8ca2534c9aff8
维护新鲜度
2026/8/19
使用量
0 次下载 · 0 次浏览
文件结构
📄 SKILL.md