slackbot

Security Findings (294)

• HighAS-002

  ⚠️Excessive Permissions ×42

  tool declares network permission

  SLACKBOT_ADD_A_CUSTOM_EMOJI_TO_A_TEAMSLACKBOT_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACKBOT_ADD_EMOJISLACKBOT_CHAT_POST_MESSAGESLACKBOT_CUSTOMIZE_URL_UNFURLSLACKBOT_CUSTOMIZE_URL_UNFURLING_IN_MESSAGESSLACKBOT_ENABLE_PUBLIC_SHARING_OF_A_FILESLACKBOT_FETCH_BOT_USER_INFORMATIONSLACKBOT_FETCH_CONVERSATION_HISTORYSLACKBOT_FETCH_CURRENT_TEAM_INFO_WITH_OPTIONAL_TEAM_SCOPESLACKBOT_FETCH_DND_STATUS_FOR_MULTIPLE_TEAM_MEMBERSSLACKBOT_FETCH_ITEM_REACTIONSSLACKBOT_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATIONSLACKBOT_FETCH_TEAM_INFOSLACKBOT_FETCH_WORKSPACE_SETTINGS_INFORMATIONSLACKBOT_GET_REMOTE_FILESLACKBOT_LIST_REMOTE_FILESSLACKBOT_LIST_S_REMOTE_FILES_WITH_FILTERSSLACKBOT_LIST_TEAM_CUSTOM_EMOJISSLACKBOT_REGISTERS_A_NEW_CALL_WITH_PARTICIPANTSSLACKBOT_REMOVE_A_REMOTE_FILESLACKBOT_RETRIEVE_DETAILED_INFORMATION_ABOUT_A_FILESLACKBOT_RETRIEVE_MESSAGE_PERMALINK_URLSLACKBOT_RETRIEVE_REMOTE_FILE_INFO_IN_SLACKSLACKBOT_REVOKE_PUBLIC_SHARING_ACCESS_FOR_A_FILESLACKBOT_SCHEDULE_MESSAGESLACKBOT_SCHEDULES_A_MESSAGE_TO_A_CHANNEL_AT_A_SPECIFIED_TIMESLACKBOT_SEARCH_ALLSLACKBOT_SEARCH_FOR_MESSAGES_WITH_QUERYSLACKBOT_SEARCH_MESSAGESSLACKBOT_SEND_EPHEMERAL_MESSAGESLACKBOT_SEND_MESSAGESLACKBOT_SENDS_A_MESSAGE_TO_A_CHANNELSLACKBOT_SENDS_EPHEMERAL_MESSAGES_TO_CHANNEL_USERSSLACKBOT_SHARE_REMOTE_FILE_IN_CHANNELSSLACKBOT_START_CALLSLACKBOT_START_REAL_TIME_MESSAGING_SESSIONSLACKBOT_UPDATE_CALL_INFORMATIONSLACKBOT_UPDATES_AN_EXISTING_REMOTE_FILE

  tool declares exec permission

  SLACKBOT_CREATE_A_USER_GROUPSLACKBOT_CREATE_CHANNEL_BASED_CONVERSATIONSLACKBOT_UPDATE_AN_EXISTING_USER_GROUP

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-010

  🔑Insecure Secret Handling ×9

  input parameter "token" appears to accept a secret or credential

  SLACKBOT_ADD_A_CUSTOM_EMOJI_TO_A_TEAMSLACKBOT_ADD_AN_EMOJI_ALIAS_IN_SLACKSLACKBOT_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACKBOT_ADD_EMOJISLACKBOT_DELETE_USER_PROFILE_PHOTOSLACKBOT_REMOVE_A_REMOTE_FILESLACKBOT_RENAME_AN_EMOJISLACKBOT_UPDATES_AN_EXISTING_REMOTE_FILESLACKBOT_UPLOAD_OR_CREATE_A_FILE_IN_SLACK

  Fix: Avoid accepting raw credentials as input parameters. Use secret managers (e.g. 1Password CLI, AWS Secrets Manager) and ensure credentials are never logged or stored in agent traces.

• MediumAS-002

  ⚠️Excessive Permissions ×50

  tool declares fs permission

  SLACKBOT_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACKBOT_ADD_A_STAR_TO_AN_ITEMSLACKBOT_CREATE_A_REMINDERSLACKBOT_CREATE_A_USER_GROUPSLACKBOT_CREATE_CANVASSLACKBOT_CREATE_CHANNELSLACKBOT_CREATE_CHANNEL_BASED_CONVERSATIONSLACKBOT_DELETE_A_COMMENT_ON_A_FILESLACKBOT_DELETE_A_FILE_BY_IDSLACKBOT_DELETE_A_PUBLIC_OR_PRIVATE_CHANNELSLACKBOT_DELETE_A_REMINDERSLACKBOT_DELETE_A_SCHEDULED_MESSAGE_IN_A_CHATSLACKBOT_DELETE_CANVASSLACKBOT_DELETES_A_MESSAGE_FROM_A_CHATSLACKBOT_DELETE_USER_PROFILE_PHOTOSLACKBOT_ENABLE_PUBLIC_SHARING_OF_A_FILESLACKBOT_FETCH_ITEM_REACTIONSSLACKBOT_GET_REMOTE_FILESLACKBOT_LIST_ALL_USERSSLACKBOT_LIST_CANVASESSLACKBOT_LIST_FILES_WITH_FILTERS_IN_SLACKSLACKBOT_LIST_REMOTE_FILESSLACKBOT_LISTS_PINNED_ITEMS_IN_A_CHANNELSLACKBOT_LIST_S_REMOTE_FILES_WITH_FILTERSSLACKBOT_LIST_USER_REACTIONSSLACKBOT_REMOVE_A_REMOTE_FILESLACKBOT_REMOVE_A_STAR_FROM_AN_ITEMSLACKBOT_REMOVE_A_USER_FROM_A_CONVERSATIONSLACKBOT_REMOVE_CALL_PARTICIPANTSSLACKBOT_REMOVE_REACTION_FROM_ITEMSLACKBOT_RETRIEVE_DETAILED_INFORMATION_ABOUT_A_FILESLACKBOT_RETRIEVE_REMOTE_FILE_INFO_IN_SLACKSLACKBOT_RETRIEVE_TEAM_PROFILE_DETAILSSLACKBOT_RETRIEVE_USER_PROFILE_INFORMATIONSLACKBOT_REVOKE_PUBLIC_SHARING_ACCESS_FOR_A_FILESLACKBOT_SEARCH_ALLSLACKBOT_SEARCH_FOR_MESSAGES_WITH_QUERYSLACKBOT_SEARCH_MESSAGESSLACKBOT_SET_PROFILE_PHOTOSLACKBOT_SET_USER_PROFILE_INFORMATIONSLACKBOT_SET_USER_PROFILE_PHOTO_WITH_CROPPING_OPTIONSSLACKBOT_SHARE_REMOTE_FILE_IN_CHANNELSSLACKBOT_UPDATE_AN_EXISTING_USER_GROUPSLACKBOT_UPDATE_CALL_INFORMATIONSLACKBOT_UPDATES_A_MESSAGESLACKBOT_UPDATES_AN_EXISTING_REMOTE_FILESLACKBOT_UPDATE_USER_GROUP_MEMBERSSLACKBOT_UPLOAD_OR_CREATE_A_FILE_IN_SLACK

  tool declares db permission

  SLACKBOT_SEARCH_FOR_MESSAGES_WITH_QUERYSLACKBOT_SEARCH_MESSAGES

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×43

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  SLACKBOT_ADD_A_CUSTOM_EMOJI_TO_A_TEAMSLACKBOT_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACKBOT_ADD_EMOJISLACKBOT_CHAT_POST_MESSAGESLACKBOT_CREATE_A_USER_GROUPSLACKBOT_CREATE_CHANNEL_BASED_CONVERSATIONSLACKBOT_CUSTOMIZE_URL_UNFURLSLACKBOT_CUSTOMIZE_URL_UNFURLING_IN_MESSAGESSLACKBOT_ENABLE_PUBLIC_SHARING_OF_A_FILESLACKBOT_FETCH_BOT_USER_INFORMATIONSLACKBOT_FETCH_CONVERSATION_HISTORYSLACKBOT_FETCH_CURRENT_TEAM_INFO_WITH_OPTIONAL_TEAM_SCOPESLACKBOT_FETCH_DND_STATUS_FOR_MULTIPLE_TEAM_MEMBERSSLACKBOT_FETCH_ITEM_REACTIONSSLACKBOT_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATIONSLACKBOT_FETCH_TEAM_INFOSLACKBOT_FETCH_WORKSPACE_SETTINGS_INFORMATIONSLACKBOT_GET_REMOTE_FILESLACKBOT_INVITE_USER_TO_CHANNELSLACKBOT_LIST_REMOTE_FILESSLACKBOT_LIST_S_REMOTE_FILES_WITH_FILTERSSLACKBOT_LIST_TEAM_CUSTOM_EMOJISSLACKBOT_REGISTERS_A_NEW_CALL_WITH_PARTICIPANTSSLACKBOT_REMOVE_A_REMOTE_FILESLACKBOT_RETRIEVE_DETAILED_INFORMATION_ABOUT_A_FILESLACKBOT_RETRIEVE_MESSAGE_PERMALINK_URLSLACKBOT_RETRIEVE_REMOTE_FILE_INFO_IN_SLACKSLACKBOT_REVOKE_PUBLIC_SHARING_ACCESS_FOR_A_FILESLACKBOT_SCHEDULE_MESSAGESLACKBOT_SCHEDULES_A_MESSAGE_TO_A_CHANNEL_AT_A_SPECIFIED_TIMESLACKBOT_SEARCH_ALLSLACKBOT_SEARCH_FOR_MESSAGES_WITH_QUERYSLACKBOT_SEARCH_MESSAGESSLACKBOT_SEND_EPHEMERAL_MESSAGESLACKBOT_SEND_MESSAGESLACKBOT_SENDS_A_MESSAGE_TO_A_CHANNELSLACKBOT_SENDS_EPHEMERAL_MESSAGES_TO_CHANNEL_USERSSLACKBOT_SHARE_REMOTE_FILE_IN_CHANNELSSLACKBOT_START_CALLSLACKBOT_START_REAL_TIME_MESSAGING_SESSIONSLACKBOT_UPDATE_AN_EXISTING_USER_GROUPSLACKBOT_UPDATE_CALL_INFORMATIONSLACKBOT_UPDATES_AN_EXISTING_REMOTE_FILE

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×8

  input schema exposes 16 properties (threshold: 10)

  SLACKBOT_CHAT_POST_MESSAGESLACKBOT_SEND_MESSAGESLACKBOT_SENDS_A_MESSAGE_TO_A_CHANNEL

  tool declares http permission

  SLACKBOT_INVITE_USER_TO_CHANNEL

  input schema exposes 13 properties (threshold: 10)

  SLACKBOT_SCHEDULE_MESSAGESLACKBOT_SCHEDULES_A_MESSAGE_TO_A_CHANNEL_AT_A_SPECIFIED_TIME

  input schema exposes 12 properties (threshold: 10)

  SLACKBOT_SEND_EPHEMERAL_MESSAGESLACKBOT_SENDS_EPHEMERAL_MESSAGES_TO_CHANNEL_USERS

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×142

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  SLACKBOT_ACTIVATE_OR_MODIFY_DO_NOT_DISTURB_DURATIONSLACKBOT_ADD_A_CUSTOM_EMOJI_TO_A_TEAMSLACKBOT_ADD_AN_EMOJI_ALIAS_IN_SLACKSLACKBOT_ADD_A_REMOTE_FILE_FROM_A_SERVICESLACKBOT_ADD_A_STAR_TO_AN_ITEMSLACKBOT_ADD_CALL_PARTICIPANTSSLACKBOT_ADD_EMOJISLACKBOT_ADD_REACTION_TO_AN_ITEMSLACKBOT_ARCHIVE_A_CONVERSATIONSLACKBOT_ARCHIVE_A_PUBLIC_OR_PRIVATE_CHANNELSLACKBOT_CHAT_POST_MESSAGESLACKBOT_CLEAR_STATUSSLACKBOT_CLOSE_DM_OR_MULTI_PERSON_DMSLACKBOT_CREATE_A_REMINDERSLACKBOT_CREATE_A_USER_GROUPSLACKBOT_CREATE_CANVASSLACKBOT_CREATE_CHANNELSLACKBOT_CREATE_CHANNEL_BASED_CONVERSATIONSLACKBOT_CUSTOMIZE_URL_UNFURLSLACKBOT_CUSTOMIZE_URL_UNFURLING_IN_MESSAGESSLACKBOT_DELETE_A_COMMENT_ON_A_FILESLACKBOT_DELETE_A_FILE_BY_IDSLACKBOT_DELETE_A_PUBLIC_OR_PRIVATE_CHANNELSLACKBOT_DELETE_A_REMINDERSLACKBOT_DELETE_A_SCHEDULED_MESSAGE_IN_A_CHATSLACKBOT_DELETE_CANVASSLACKBOT_DELETES_A_MESSAGE_FROM_A_CHATSLACKBOT_DELETE_USER_PROFILE_PHOTOSLACKBOT_DISABLE_AN_EXISTING_USER_GROUPSLACKBOT_EDIT_CANVASSLACKBOT_ENABLE_A_SPECIFIED_USER_GROUPSLACKBOT_ENABLE_PUBLIC_SHARING_OF_A_FILESLACKBOT_END_A_CALL_WITH_DURATION_AND_IDSLACKBOT_END_SNOOZESLACKBOT_END_USER_DO_NOT_DISTURB_SESSIONSLACKBOT_END_USER_SNOOZE_MODE_IMMEDIATELYSLACKBOT_FETCH_BOT_USER_INFORMATIONSLACKBOT_FETCH_CONVERSATION_HISTORYSLACKBOT_FETCH_CURRENT_TEAM_INFO_WITH_OPTIONAL_TEAM_SCOPESLACKBOT_FETCH_DND_STATUS_FOR_MULTIPLE_TEAM_MEMBERSSLACKBOT_FETCH_ITEM_REACTIONSSLACKBOT_FETCH_MESSAGE_THREAD_FROM_A_CONVERSATIONSLACKBOT_FETCH_TEAM_INFOSLACKBOT_FETCH_WORKSPACE_SETTINGS_INFORMATIONSLACKBOT_FIND_CHANNELSSLACKBOT_FIND_USER_BY_EMAIL_ADDRESSSLACKBOT_FIND_USERSSLACKBOT_GET_CANVASSLACKBOT_GET_CHANNEL_CONVERSATION_PREFERENCESSLACKBOT_GET_REMINDER_INFORMATIONSLACKBOT_GET_REMOTE_FILESLACKBOT_GET_TEAM_DND_STATUSSLACKBOT_GET_USER_PRESENCE_INFOSLACKBOT_INITIATES_CHANNEL_BASED_CONVERSATIONSSLACKBOT_INVITE_USERS_TO_A_CHANNELSLACKBOT_INVITE_USER_TO_CHANNELSLACKBOT_INVITE_USER_TO_WORKSPACESLACKBOT_INVITE_USER_TO_WORKSPACE_WITH_OPTIONAL_CHANNEL_INVITESSLACKBOT_JOIN_AN_EXISTING_CONVERSATIONSLACKBOT_LEAVE_A_CONVERSATIONSLACKBOT_LIST_ACCESSIBLE_CONVERSATIONS_FOR_A_USERSLACKBOT_LIST_ALL_CHANNELSSLACKBOT_LIST_ALL_TEAM_CHANNELS_WITH_VARIOUS_FILTERSSLACKBOT_LIST_ALL_TEAM_USERS_WITH_PAGINATIONSLACKBOT_LIST_ALL_USERSSLACKBOT_LIST_ALL_USERS_IN_A_USER_GROUPSLACKBOT_LIST_CANVASESSLACKBOT_LIST_CONVERSATIONSSLACKBOT_LIST_FILES_WITH_FILTERS_IN_SLACKSLACKBOT_LIST_REMINDERSSLACKBOT_LIST_REMOTE_FILESSLACKBOT_LIST_SCHEDULED_MESSAGESSLACKBOT_LIST_SCHEDULED_MESSAGES_IN_A_CHANNELSLACKBOT_LISTS_PINNED_ITEMS_IN_A_CHANNELSLACKBOT_LIST_S_REMOTE_FILES_WITH_FILTERSSLACKBOT_LIST_STARRED_ITEMSSLACKBOT_LISTS_USER_S_STARRED_ITEMS_WITH_PAGINATIONSLACKBOT_LIST_TEAM_CUSTOM_EMOJISSLACKBOT_LIST_USER_GROUPS_FOR_TEAM_WITH_OPTIONSSLACKBOT_LIST_USER_REACTIONSSLACKBOT_LIST_USER_REMINDERS_WITH_DETAILSSLACKBOT_LIST_WORKSPACE_USERSSLACKBOT_LOOKUP_CANVAS_SECTIONSSLACKBOT_MANUALLY_SET_USER_PRESENCESLACKBOT_MARK_REMINDER_AS_COMPLETESLACKBOT_OPEN_DMSLACKBOT_OPEN_OR_RESUME_DIRECT_OR_MULTI_PERSON_MESSAGESSLACKBOT_PINS_AN_ITEM_TO_A_CHANNELSLACKBOT_REGISTER_CALL_PARTICIPANTS_REMOVALSLACKBOT_REGISTERS_A_NEW_CALL_WITH_PARTICIPANTSSLACKBOT_REGISTERS_NEW_CALL_PARTICIPANTSSLACKBOT_REMOVE_A_REMOTE_FILESLACKBOT_REMOVE_A_STAR_FROM_AN_ITEMSLACKBOT_REMOVE_A_USER_FROM_A_CONVERSATIONSLACKBOT_REMOVE_CALL_PARTICIPANTSSLACKBOT_REMOVE_REACTION_FROM_ITEMSLACKBOT_RENAME_A_CHANNELSLACKBOT_RENAME_A_CONVERSATIONSLACKBOT_RENAME_AN_EMOJISLACKBOT_RETRIEVE_A_USER_S_IDENTITY_DETAILSSLACKBOT_RETRIEVE_CALL_INFORMATIONSLACKBOT_RETRIEVE_CONVERSATION_INFORMATIONSLACKBOT_RETRIEVE_CONVERSATION_MEMBERS_LISTSLACKBOT_RETRIEVE_CURRENT_USER_DND_STATUSSLACKBOT_RETRIEVE_DETAILED_INFORMATION_ABOUT_A_FILESLACKBOT_RETRIEVE_DETAILED_USER_INFORMATIONSLACKBOT_RETRIEVE_MESSAGE_PERMALINK_URLSLACKBOT_RETRIEVE_REMOTE_FILE_INFO_IN_SLACKSLACKBOT_RETRIEVE_TEAM_PROFILE_DETAILSSLACKBOT_RETRIEVE_USER_PROFILE_INFORMATIONSLACKBOT_REVERSE_A_CONVERSATION_S_ARCHIVAL_STATUSSLACKBOT_REVOKE_PUBLIC_SHARING_ACCESS_FOR_A_FILESLACKBOT_SCHEDULE_MESSAGESLACKBOT_SCHEDULES_A_MESSAGE_TO_A_CHANNEL_AT_A_SPECIFIED_TIMESLACKBOT_SEARCH_ALLSLACKBOT_SEARCH_FOR_MESSAGES_WITH_QUERYSLACKBOT_SEARCH_MESSAGESSLACKBOT_SEND_EPHEMERAL_MESSAGESLACKBOT_SEND_MESSAGESLACKBOT_SENDS_A_MESSAGE_TO_A_CHANNELSLACKBOT_SENDS_EPHEMERAL_MESSAGES_TO_CHANNEL_USERSSLACKBOT_SET_A_CONVERSATION_S_PURPOSESLACKBOT_SET_DND_DURATIONSLACKBOT_SET_PROFILE_PHOTOSLACKBOT_SET_READ_CURSOR_IN_A_CONVERSATIONSLACKBOT_SET_STATUSSLACKBOT_SET_THE_TOPIC_OF_A_CONVERSATIONSLACKBOT_SET_USER_PROFILE_INFORMATIONSLACKBOT_SET_USER_PROFILE_PHOTO_WITH_CROPPING_OPTIONSSLACKBOT_SHARE_A_ME_MESSAGE_IN_A_CHANNELSLACKBOT_SHARE_REMOTE_FILE_IN_CHANNELSSLACKBOT_START_CALLSLACKBOT_START_REAL_TIME_MESSAGING_SESSIONSLACKBOT_UNARCHIVE_A_PUBLIC_OR_PRIVATE_CHANNELSLACKBOT_UNARCHIVE_CHANNELSLACKBOT_UNPIN_ITEM_FROM_CHANNELSLACKBOT_UPDATE_AN_EXISTING_USER_GROUPSLACKBOT_UPDATE_CALL_INFORMATIONSLACKBOT_UPDATES_A_MESSAGESLACKBOT_UPDATES_AN_EXISTING_REMOTE_FILESLACKBOT_UPDATE_USER_GROUP_MEMBERSSLACKBOT_UPLOAD_OR_CREATE_A_FILE_IN_SLACK

  Fix: Review and remediate the identified issue.