Slack Backup

Back up files uploaded to a Slack channel to the local doc/backup directory. Supports smart matching: multiple files, filename prefix/keyword filter, file ty...

This skill is inconsistent and potentially unsafe as packaged. Before installing or running it: 1) Do not provide Slack credentials yet — SKILL.md doesn't say which env var or how the token is supplied. 2) Inspect the referenced ../shared/slack_downloader.py and ../shared/slack_args.sh files (they are not included) — the bash script will execute and source those files, so they must be trusted. 3) If those shared files come from the platform, ask the maintainer which Slack token env var is required and where that token will be stored/used. 4) If you proceed, test in an isolated environment and verify the downloader's code to ensure it only talks to Slack and writes only to the backup directory. 5) If the author cannot provide the missing files or a convincing explanation for why credentials are omitted, do not install — the mismatch is suspicious (likely poor packaging or hidden behavior), not proof of intent to harm, but worthy of caution.

Type: OpenClaw Skill Name: slack-backup Version: 1.0.0 The slack-backup skill is a legitimate utility designed to download files from Slack to a local backup directory. The SKILL.md file contains notably defensive instructions that explicitly forbid the AI agent from creating or modifying files directly or fabricating content, which mitigates common prompt-injection risks. The shell script (slack_backup.sh) is a straightforward wrapper that passes environment variables to a downloader script, and no evidence of malicious intent, data exfiltration, or unauthorized persistence was found.