Slack Assistant

Slack API integration with smart AI features — send messages, read channels, search conversations, and manage workspaces with Claude-powered summarization an...

This skill's behavior is mostly coherent with a Slack integration that optionally uses EvoLink's AI API, but the registry metadata is incomplete: it does require python3 and curl and you must supply Slack credentials (bot token or client_id/client_secret) and optionally EVOLINK_API_KEY. Before installing, verify the GitHub repo and publisher (the SKILL.md and README reference EvoLinkAI and a GitHub link), and inspect the provided scripts yourself. If you enable AI features (set EVOLINK_API_KEY), understand that message content, sender names, and channel info will be sent to api.evolink.ai. Only populate credentials you trust the code to use, and consider creating and installing a Slack app with minimal scopes for this purpose and running the OAuth flow on a machine you control. Finally, ask the publisher to fix the registry metadata so required binaries and credential expectations are explicit.

Type: OpenClaw Skill Name: slack-assistant Version: 1.0.0 The skill integrates Slack with an external AI service (evolink.ai), which involves transmitting Slack message history and metadata to a third-party API (api.evolink.ai). While this behavior is documented, the implementation in `scripts/slack.sh` contains critical command injection vulnerabilities. Specifically, user-controlled data from Slack messages and channel names is unsafely interpolated into Python scripts executed via `python3 -c` (e.g., in the `evolink_ai` and `resolve_channel` functions). This could allow a malicious Slack message to execute arbitrary code on the user's machine when the agent performs actions like summarization or searching.