slack-smithery

Security Findings (294)

• HighAS-002

  ⚠️Excessive Permissions ×42

  tool declares network permission

  SLACK_ADD_A_CUSTOM_EMOJI_TO_A_SLACK_TEAMSLACK_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACK_ADD_EMOJISLACK_CHAT_POST_MESSAGESLACK_CUSTOMIZE_URL_UNFURLSLACK_CUSTOMIZE_URL_UNFURLING_IN_MESSAGESSLACK_ENABLE_PUBLIC_SHARING_OF_A_FILESLACK_FETCH_BOT_USER_INFORMATIONSLACK_FETCH_CONVERSATION_HISTORYSLACK_FETCH_CURRENT_TEAM_INFO_WITH_OPTIONAL_TEAM_SCOPESLACK_FETCH_DND_STATUS_FOR_MULTIPLE_TEAM_MEMBERSSLACK_FETCH_ITEM_REACTIONSSLACK_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATIONSLACK_FETCH_TEAM_INFOSLACK_FETCH_WORKSPACE_SETTINGS_INFORMATIONSLACK_GET_REMOTE_FILESLACK_LIST_REMOTE_FILESSLACK_LIST_SLACK_S_REMOTE_FILES_WITH_FILTERSSLACK_LIST_TEAM_CUSTOM_EMOJISSLACK_REGISTERS_A_NEW_CALL_WITH_PARTICIPANTSSLACK_REMOVE_A_REMOTE_FILESLACK_RETRIEVE_DETAILED_INFORMATION_ABOUT_A_FILESLACK_RETRIEVE_MESSAGE_PERMALINK_URLSLACK_RETRIEVE_REMOTE_FILE_INFO_IN_SLACKSLACK_REVOKE_PUBLIC_SHARING_ACCESS_FOR_A_FILESLACK_SCHEDULE_MESSAGESLACK_SCHEDULES_A_MESSAGE_TO_A_CHANNEL_AT_A_SPECIFIED_TIMESLACK_SEARCH_ALLSLACK_SEARCH_FOR_MESSAGES_WITH_QUERYSLACK_SEARCH_MESSAGESSLACK_SEND_EPHEMERAL_MESSAGESLACK_SEND_MESSAGESLACK_SENDS_A_MESSAGE_TO_A_SLACK_CHANNELSLACK_SENDS_EPHEMERAL_MESSAGES_TO_CHANNEL_USERSSLACK_SHARE_REMOTE_FILE_IN_CHANNELSSLACK_START_CALLSLACK_START_REAL_TIME_MESSAGING_SESSIONSLACK_UPDATES_AN_EXISTING_REMOTE_FILESLACK_UPDATE_SLACK_CALL_INFORMATION

  tool declares exec permission

  SLACK_CREATE_A_SLACK_USER_GROUPSLACK_CREATE_CHANNEL_BASED_CONVERSATIONSLACK_UPDATE_AN_EXISTING_SLACK_USER_GROUP

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-010

  🔑Insecure Secret Handling ×9

  input parameter "token" appears to accept a secret or credential

  SLACK_ADD_A_CUSTOM_EMOJI_TO_A_SLACK_TEAMSLACK_ADD_AN_EMOJI_ALIAS_IN_SLACKSLACK_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACK_ADD_EMOJISLACK_DELETE_USER_PROFILE_PHOTOSLACK_REMOVE_A_REMOTE_FILESLACK_RENAME_AN_EMOJISLACK_UPDATES_AN_EXISTING_REMOTE_FILESLACK_UPLOAD_OR_CREATE_A_FILE_IN_SLACK

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• MediumAS-002

  ⚠️Excessive Permissions ×50

  tool declares fs permission

  SLACK_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACK_ADD_A_STAR_TO_AN_ITEMSLACK_CREATE_A_REMINDERSLACK_CREATE_A_SLACK_USER_GROUPSLACK_CREATE_CANVASSLACK_CREATE_CHANNELSLACK_CREATE_CHANNEL_BASED_CONVERSATIONSLACK_DELETE_A_COMMENT_ON_A_FILESLACK_DELETE_A_FILE_BY_IDSLACK_DELETE_A_PUBLIC_OR_PRIVATE_CHANNELSLACK_DELETE_A_SCHEDULED_MESSAGE_IN_A_CHATSLACK_DELETE_A_SLACK_REMINDERSLACK_DELETE_CANVASSLACK_DELETES_A_MESSAGE_FROM_A_CHATSLACK_DELETE_USER_PROFILE_PHOTOSLACK_ENABLE_PUBLIC_SHARING_OF_A_FILESLACK_FETCH_ITEM_REACTIONSSLACK_GET_REMOTE_FILESLACK_LIST_ALL_USERSSLACK_LIST_CANVASESSLACK_LIST_FILES_WITH_FILTERS_IN_SLACKSLACK_LIST_REMOTE_FILESSLACK_LIST_SLACK_S_REMOTE_FILES_WITH_FILTERSSLACK_LISTS_PINNED_ITEMS_IN_A_CHANNELSLACK_LIST_USER_REACTIONSSLACK_REMOVE_A_REMOTE_FILESLACK_REMOVE_A_STAR_FROM_AN_ITEMSLACK_REMOVE_A_USER_FROM_A_CONVERSATIONSLACK_REMOVE_CALL_PARTICIPANTSSLACK_REMOVE_REACTION_FROM_ITEMSLACK_RETRIEVE_DETAILED_INFORMATION_ABOUT_A_FILESLACK_RETRIEVE_REMOTE_FILE_INFO_IN_SLACKSLACK_RETRIEVE_TEAM_PROFILE_DETAILSSLACK_RETRIEVE_USER_PROFILE_INFORMATIONSLACK_REVOKE_PUBLIC_SHARING_ACCESS_FOR_A_FILESLACK_SEARCH_ALLSLACK_SEARCH_FOR_MESSAGES_WITH_QUERYSLACK_SEARCH_MESSAGESSLACK_SET_PROFILE_PHOTOSLACK_SET_SLACK_USER_PROFILE_INFORMATIONSLACK_SET_USER_PROFILE_PHOTO_WITH_CROPPING_OPTIONSSLACK_SHARE_REMOTE_FILE_IN_CHANNELSSLACK_UPDATE_AN_EXISTING_SLACK_USER_GROUPSLACK_UPDATES_AN_EXISTING_REMOTE_FILESLACK_UPDATES_A_SLACK_MESSAGESLACK_UPDATE_SLACK_CALL_INFORMATIONSLACK_UPDATE_USER_GROUP_MEMBERSSLACK_UPLOAD_OR_CREATE_A_FILE_IN_SLACK

  tool declares db permission

  SLACK_SEARCH_FOR_MESSAGES_WITH_QUERYSLACK_SEARCH_MESSAGES

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×43

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  SLACK_ADD_A_CUSTOM_EMOJI_TO_A_SLACK_TEAMSLACK_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACK_ADD_EMOJISLACK_CHAT_POST_MESSAGESLACK_CREATE_A_SLACK_USER_GROUPSLACK_CREATE_CHANNEL_BASED_CONVERSATIONSLACK_CUSTOMIZE_URL_UNFURLSLACK_CUSTOMIZE_URL_UNFURLING_IN_MESSAGESSLACK_ENABLE_PUBLIC_SHARING_OF_A_FILESLACK_FETCH_BOT_USER_INFORMATIONSLACK_FETCH_CONVERSATION_HISTORYSLACK_FETCH_CURRENT_TEAM_INFO_WITH_OPTIONAL_TEAM_SCOPESLACK_FETCH_DND_STATUS_FOR_MULTIPLE_TEAM_MEMBERSSLACK_FETCH_ITEM_REACTIONSSLACK_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATIONSLACK_FETCH_TEAM_INFOSLACK_FETCH_WORKSPACE_SETTINGS_INFORMATIONSLACK_GET_REMOTE_FILESLACK_INVITE_USER_TO_CHANNELSLACK_LIST_REMOTE_FILESSLACK_LIST_SLACK_S_REMOTE_FILES_WITH_FILTERSSLACK_LIST_TEAM_CUSTOM_EMOJISSLACK_REGISTERS_A_NEW_CALL_WITH_PARTICIPANTSSLACK_REMOVE_A_REMOTE_FILESLACK_RETRIEVE_DETAILED_INFORMATION_ABOUT_A_FILESLACK_RETRIEVE_MESSAGE_PERMALINK_URLSLACK_RETRIEVE_REMOTE_FILE_INFO_IN_SLACKSLACK_REVOKE_PUBLIC_SHARING_ACCESS_FOR_A_FILESLACK_SCHEDULE_MESSAGESLACK_SCHEDULES_A_MESSAGE_TO_A_CHANNEL_AT_A_SPECIFIED_TIMESLACK_SEARCH_ALLSLACK_SEARCH_FOR_MESSAGES_WITH_QUERYSLACK_SEARCH_MESSAGESSLACK_SEND_EPHEMERAL_MESSAGESLACK_SEND_MESSAGESLACK_SENDS_A_MESSAGE_TO_A_SLACK_CHANNELSLACK_SENDS_EPHEMERAL_MESSAGES_TO_CHANNEL_USERSSLACK_SHARE_REMOTE_FILE_IN_CHANNELSSLACK_START_CALLSLACK_START_REAL_TIME_MESSAGING_SESSIONSLACK_UPDATE_AN_EXISTING_SLACK_USER_GROUPSLACK_UPDATES_AN_EXISTING_REMOTE_FILESLACK_UPDATE_SLACK_CALL_INFORMATION

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×8

  input schema exposes 16 properties (threshold: 10)

  SLACK_CHAT_POST_MESSAGESLACK_SEND_MESSAGESLACK_SENDS_A_MESSAGE_TO_A_SLACK_CHANNEL

  tool declares http permission

  SLACK_INVITE_USER_TO_CHANNEL

  input schema exposes 13 properties (threshold: 10)

  SLACK_SCHEDULE_MESSAGESLACK_SCHEDULES_A_MESSAGE_TO_A_CHANNEL_AT_A_SPECIFIED_TIME

  input schema exposes 12 properties (threshold: 10)

  SLACK_SEND_EPHEMERAL_MESSAGESLACK_SENDS_EPHEMERAL_MESSAGES_TO_CHANNEL_USERS

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×142

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  SLACK_ACTIVATE_OR_MODIFY_DO_NOT_DISTURB_DURATIONSLACK_ADD_A_CUSTOM_EMOJI_TO_A_SLACK_TEAMSLACK_ADD_AN_EMOJI_ALIAS_IN_SLACKSLACK_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACK_ADD_A_STAR_TO_AN_ITEMSLACK_ADD_CALL_PARTICIPANTSSLACK_ADD_EMOJISLACK_ADD_REACTION_TO_AN_ITEMSLACK_ARCHIVE_A_PUBLIC_OR_PRIVATE_CHANNELSLACK_ARCHIVE_A_SLACK_CONVERSATIONSLACK_CHAT_POST_MESSAGESLACK_CLEAR_STATUSSLACK_CLOSE_DM_OR_MULTI_PERSON_DMSLACK_CREATE_A_REMINDERSLACK_CREATE_A_SLACK_USER_GROUPSLACK_CREATE_CANVASSLACK_CREATE_CHANNELSLACK_CREATE_CHANNEL_BASED_CONVERSATIONSLACK_CUSTOMIZE_URL_UNFURLSLACK_CUSTOMIZE_URL_UNFURLING_IN_MESSAGESSLACK_DELETE_A_COMMENT_ON_A_FILESLACK_DELETE_A_FILE_BY_IDSLACK_DELETE_A_PUBLIC_OR_PRIVATE_CHANNELSLACK_DELETE_A_SCHEDULED_MESSAGE_IN_A_CHATSLACK_DELETE_A_SLACK_REMINDERSLACK_DELETE_CANVASSLACK_DELETES_A_MESSAGE_FROM_A_CHATSLACK_DELETE_USER_PROFILE_PHOTOSLACK_DISABLE_AN_EXISTING_SLACK_USER_GROUPSLACK_EDIT_CANVASSLACK_ENABLE_A_SPECIFIED_USER_GROUPSLACK_ENABLE_PUBLIC_SHARING_OF_A_FILESLACK_END_A_CALL_WITH_DURATION_AND_IDSLACK_END_SNOOZESLACK_END_USER_DO_NOT_DISTURB_SESSIONSLACK_END_USER_SNOOZE_MODE_IMMEDIATELYSLACK_FETCH_BOT_USER_INFORMATIONSLACK_FETCH_CONVERSATION_HISTORYSLACK_FETCH_CURRENT_TEAM_INFO_WITH_OPTIONAL_TEAM_SCOPESLACK_FETCH_DND_STATUS_FOR_MULTIPLE_TEAM_MEMBERSSLACK_FETCH_ITEM_REACTIONSSLACK_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATIONSLACK_FETCH_TEAM_INFOSLACK_FETCH_WORKSPACE_SETTINGS_INFORMATIONSLACK_FIND_CHANNELSSLACK_FIND_USER_BY_EMAIL_ADDRESSSLACK_FIND_USERSSLACK_GET_CANVASSLACK_GET_CHANNEL_CONVERSATION_PREFERENCESSLACK_GET_REMINDER_INFORMATIONSLACK_GET_REMOTE_FILESLACK_GET_TEAM_DND_STATUSSLACK_GET_USER_PRESENCE_INFOSLACK_INITIATES_CHANNEL_BASED_CONVERSATIONSSLACK_INVITE_USERS_TO_A_SLACK_CHANNELSLACK_INVITE_USER_TO_CHANNELSLACK_INVITE_USER_TO_WORKSPACESLACK_INVITE_USER_TO_WORKSPACE_WITH_OPTIONAL_CHANNEL_INVITESSLACK_JOIN_AN_EXISTING_CONVERSATIONSLACK_LEAVE_A_CONVERSATIONSLACK_LIST_ACCESSIBLE_CONVERSATIONS_FOR_A_USERSLACK_LIST_ALL_CHANNELSSLACK_LIST_ALL_SLACK_TEAM_CHANNELS_WITH_VARIOUS_FILTERSSLACK_LIST_ALL_SLACK_TEAM_USERS_WITH_PAGINATIONSLACK_LIST_ALL_USERSSLACK_LIST_ALL_USERS_IN_A_USER_GROUPSLACK_LIST_CANVASESSLACK_LIST_CONVERSATIONSSLACK_LIST_FILES_WITH_FILTERS_IN_SLACKSLACK_LIST_REMINDERSSLACK_LIST_REMOTE_FILESSLACK_LIST_SCHEDULED_MESSAGESSLACK_LIST_SCHEDULED_MESSAGES_IN_A_CHANNELSLACK_LIST_SLACK_S_REMOTE_FILES_WITH_FILTERSSLACK_LISTS_PINNED_ITEMS_IN_A_CHANNELSLACK_LIST_STARRED_ITEMSSLACK_LISTS_USER_S_STARRED_ITEMS_WITH_PAGINATIONSLACK_LIST_TEAM_CUSTOM_EMOJISSLACK_LIST_USER_GROUPS_FOR_TEAM_WITH_OPTIONSSLACK_LIST_USER_REACTIONSSLACK_LIST_USER_REMINDERS_WITH_DETAILSSLACK_LIST_WORKSPACE_USERSSLACK_LOOKUP_CANVAS_SECTIONSSLACK_MANUALLY_SET_USER_PRESENCESLACK_MARK_REMINDER_AS_COMPLETESLACK_OPEN_DMSLACK_OPEN_OR_RESUME_DIRECT_OR_MULTI_PERSON_MESSAGESSLACK_PINS_AN_ITEM_TO_A_CHANNELSLACK_REGISTER_CALL_PARTICIPANTS_REMOVALSLACK_REGISTERS_A_NEW_CALL_WITH_PARTICIPANTSSLACK_REGISTERS_NEW_CALL_PARTICIPANTSSLACK_REMOVE_A_REMOTE_FILESLACK_REMOVE_A_STAR_FROM_AN_ITEMSLACK_REMOVE_A_USER_FROM_A_CONVERSATIONSLACK_REMOVE_CALL_PARTICIPANTSSLACK_REMOVE_REACTION_FROM_ITEMSLACK_RENAME_A_CONVERSATIONSLACK_RENAME_AN_EMOJISLACK_RENAME_A_SLACK_CHANNELSLACK_RETRIEVE_A_USER_S_IDENTITY_DETAILSSLACK_RETRIEVE_CALL_INFORMATIONSLACK_RETRIEVE_CONVERSATION_INFORMATIONSLACK_RETRIEVE_CONVERSATION_MEMBERS_LISTSLACK_RETRIEVE_CURRENT_USER_DND_STATUSSLACK_RETRIEVE_DETAILED_INFORMATION_ABOUT_A_FILESLACK_RETRIEVE_DETAILED_USER_INFORMATIONSLACK_RETRIEVE_MESSAGE_PERMALINK_URLSLACK_RETRIEVE_REMOTE_FILE_INFO_IN_SLACKSLACK_RETRIEVE_TEAM_PROFILE_DETAILSSLACK_RETRIEVE_USER_PROFILE_INFORMATIONSLACK_REVERSE_A_CONVERSATION_S_ARCHIVAL_STATUSSLACK_REVOKE_PUBLIC_SHARING_ACCESS_FOR_A_FILESLACK_SCHEDULE_MESSAGESLACK_SCHEDULES_A_MESSAGE_TO_A_CHANNEL_AT_A_SPECIFIED_TIMESLACK_SEARCH_ALLSLACK_SEARCH_FOR_MESSAGES_WITH_QUERYSLACK_SEARCH_MESSAGESSLACK_SEND_EPHEMERAL_MESSAGESLACK_SEND_MESSAGESLACK_SENDS_A_MESSAGE_TO_A_SLACK_CHANNELSLACK_SENDS_EPHEMERAL_MESSAGES_TO_CHANNEL_USERSSLACK_SET_A_CONVERSATION_S_PURPOSESLACK_SET_DND_DURATIONSLACK_SET_PROFILE_PHOTOSLACK_SET_READ_CURSOR_IN_A_CONVERSATIONSLACK_SET_SLACK_USER_PROFILE_INFORMATIONSLACK_SET_STATUSSLACK_SET_THE_TOPIC_OF_A_CONVERSATIONSLACK_SET_USER_PROFILE_PHOTO_WITH_CROPPING_OPTIONSSLACK_SHARE_A_ME_MESSAGE_IN_A_CHANNELSLACK_SHARE_REMOTE_FILE_IN_CHANNELSSLACK_START_CALLSLACK_START_REAL_TIME_MESSAGING_SESSIONSLACK_UNARCHIVE_A_PUBLIC_OR_PRIVATE_CHANNELSLACK_UNARCHIVE_CHANNELSLACK_UNPIN_ITEM_FROM_CHANNELSLACK_UPDATE_AN_EXISTING_SLACK_USER_GROUPSLACK_UPDATES_AN_EXISTING_REMOTE_FILESLACK_UPDATES_A_SLACK_MESSAGESLACK_UPDATE_SLACK_CALL_INFORMATIONSLACK_UPDATE_USER_GROUP_MEMBERSSLACK_UPLOAD_OR_CREATE_A_FILE_IN_SLACK

  Fix: Review and remediate the identified issue.