catalan-adobe/slack-cdp
Control Slack via CDP or headless API tokens. Navigate channels, read/send messages, search conversations, check unreads, and manage status. Two modes: CDP (Slack desktop with --remote-debugging-port) for full UI control, or headless (xoxp/xoxb token) for data operations without Slack running. Triggers on: slack, read slack, search slack, slack unreads, send slack message, slack status, navigate slack, check slack, slack messages, go to channel, slack DM.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The skill intentionally uses Chrome DevTools Protocol to execute code inside the Slack renderer, read tokens from localStorage (localConfig_v2), and use those tokens to call Slack APIs — functionality that gives full access to read/send messages and user profile data and therefore can be abused for credential theft, data exfiltration, and remote control if the script is run or the debug port is exposed.
Where we found it
localStorage.localConfig_v2 token extraction via CDP Runtime.evaluate
command · 5 sites
The plugin's core slackEval function extracts the user's Slack token from localStorage.localConfig_v2 in the renderer process via CDP Runtime.evaluate, then uses it to make authenticated API calls to app.slack.com/api — this is the credential theft/exfiltration mechanism the scanner flagged.
scripts/slack-cdp.js
91
const cfg = JSON.parse(localStorage.localConfig_v2);
scripts/slack-cdp.js
94
const tk = cfg.teams[teamId].token;
scripts/slack-cdp.js
96
const body = new URLSearchParams(Object.assign({ token: tk }, p));
scripts/slack-cdp.js
97
const resp = await fetch('${API_BASE}/${apiMethod}', {
scripts/slack-cdp.js
87
async function slackEval(ws, apiMethod, params = {}) {
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The skill explicitly fetches and evaluates user-generated Slack content (via Slack API calls like conversations.history and search.messages and DOM reads in scripts/slack-cdp.js) as shown in SKILL.md and scripts/slack-cdp.js, and the workflow/chain examples use those message/search results to select channels and drive navigation or follow-up commands, so untrusted third-party content can influence agent actions.
Where we found it
app.slack.com
domain · 10 sites
The plugin fetches user-generated Slack content (messages, search results, channel lists, user profiles) from app.slack.com via CDP-evaluated API calls, and the SKILL.md chaining patterns (lines 100-118) use search/read results to drive navigation and follow-up commands — untrusted third-party content in messages can influence agent actions.
slack.com
domain · 5 sites
The SKILL.md documents headless mode API calls to slack.com/api endpoints (auth.test, conversations.history, search.messages, chat.postMessage, oauth.v2.access) which fetch user-generated content (messages, search results) — these are additional fetch sites for untrusted third-party content that can influence agent actions per the documented chaining patterns.
SKILL.md
159
curl -s -X POST https://slack.com/api/auth.test \
SKILL.md
163
curl -s -X POST https://slack.com/api/conversations.history \
SKILL.md
168
curl -s -X POST https://slack.com/api/search.messages \
SKILL.md
173
curl -s -X POST https://slack.com/api/chat.postMessage \
SKILL.md
203
curl -s -X POST https://slack.com/api/oauth.v2.access \
Slack renderer DOM (user-generated channel titles, sidebar items, tab names)
content-type · 6 sites
The plugin reads user-generated content directly from the Slack renderer DOM via CDP (channel titles, selected tab names, unread sidebar items) — this is additional untrusted third-party content that can influence agent actions when used in chaining patterns.
- Audited
- Security analysis