← 返回 Skills 市场
Slack Controller
作者
adeel-powerhouse
· GitHub ↗
· v1.0.0
471
总下载
0
收藏
3
当前安装
1
版本数
在 OpenClaw 中安装
/install slack-controller
功能描述
Control Slack via Browser Automation to send messages, manage huddles, screen share, set status, and react as the logged-in user.
安全使用建议
This package is inconsistent and worth caution. Before installing or running anything: 1) Ask the publisher for the source repository and a reproducible install script — do not run the CLI examples that reference ~/.cursor/skills/.../dist/index.js because that file is not present. 2) Do not grant Accessibility or Screen Recording until you can audit the code that will exercise those permissions. UI automation can read and type everything you see; the uploadFile action can read any local path you give it. 3) If you only need to send programmatic Slack messages, prefer using a scoped Slack bot token (least privilege) via the official API rather than full-session UI automation. 4) If you decide to proceed, require the skill author to provide: full source code, a trustworthy install host (no private short URLs), a clear explanation of why network/command_execution are required, and a reproducible audit showing no data exfiltration. 5) If you cannot obtain this, treat the skill as untrusted and do not grant OS-level automation permissions or run any referenced binaries.
功能分析
Type: OpenClaw Skill
Name: slack-controller
Version: 1.0.0
The skill is classified as suspicious due to its request for `command_execution` permission in `skill.yaml`, which allows it to run arbitrary commands on the host system. Additionally, the `uploadFile` action, combined with the `filePath` input and `network` permission, creates a significant risk of unauthorized data exfiltration if the agent is prompted maliciously or the underlying script (not provided) is vulnerable to command injection or file path manipulation.
能力评估
Purpose & Capability
SKILL.md says the skill automates the Slack web/desktop client as the logged-in user (reasonable for UI automation). However the README/CLI examples call out a local Node binary at ~/.cursor/skills/slack-controller/dist/index.js and skill.yaml declares permissions (network, command_execution) and an optional slack_bot_token. There is no install spec or code files in the package. This is internally inconsistent: a consumer cannot actually run the referenced binary as-distributed, and the declared permissions (network/command_execution) are not explained in the SKILL.md.
Instruction Scope
The instructions explicitly direct the agent to control the Slack UI, send messages, join/leave huddles, set status, perform searches, and upload local files. That implicitly grants access to the user's Slack session and any data visible in the UI. The uploadFile action takes an absolute filePath (arbitrary local-file access). Requiring Screen Recording and Accessibility on macOS is expected for UI automation, but also gives broad visibility/control. The SKILL.md does not limit what local data may be read or transmitted.
Install Mechanism
There is no install spec and there are no code files, yet CLI usage examples reference a Node script under the user's ~/.cursor path and skill.yaml implies a distributed implementation. That mismatch is a red flag: either required code is missing from the package (broken/unfinished) or the skill expects out-of-band installation from an unvetted source. Instruction-only skills are lowest risk when self-contained; this one is not self-contained.
Credentials
The registry metadata declares no required env vars, but skill.yaml exposes an optional slack_bot_token and requests network and command_execution permissions. An optional bot token is plausible as a fallback, but SKILL.md never documents using it. Network and command_execution permissions broaden the attack surface (they would allow arbitrary remote comms and running commands) and are not justified clearly by the browser-automation description.
Persistence & Privilege
always:false (normal). The skill explicitly asks the user to grant macOS Accessibility and Screen Recording and to create/use an automation browser profile; those OS-level permissions are necessary for UI automation but are sensitive because they enable observing and controlling the screen and UI. The package itself does not request persistent installation metadata, but the workflow would create persistent local profiles/cookies that the automation would reuse.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install slack-controller - 安装完成后，直接呼叫该 Skill 的名称或使用
/slack-controller触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of Slack Controller (Browser Edition):
- Automate Slack Web or Desktop App to control messaging, huddles, screen sharing, status updates, searches, and reactions as the logged-in user.
- Supports sending messages, opening chats, starting/joining huddles, sharing screens, leaving huddles, setting custom status/presence, pausing notifications, uploading files, and adding emoji reactions.
- Works via OpenClaw Chat commands or CLI commands for flexible usage.
- Requires Slack app or Chrome, macOS Screen Recording & Accessibility permissions, and initial manual login.
- Provides detailed command examples and prerequisites for setup.
元数据
常见问题
Slack Controller 是什么？
Control Slack via Browser Automation to send messages, manage huddles, screen share, set status, and react as the logged-in user. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 471 次。
如何安装 Slack Controller？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install slack-controller」即可一键安装，无需额外配置。
Slack Controller 是免费的吗？
是的，Slack Controller 完全免费（开源免费），可自由下载、安装和使用。
Slack Controller 支持哪些平台？
Slack Controller 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 Slack Controller？
由 adeel-powerhouse（@adeel-powerhouse）开发并维护，当前版本 v1.0.0。
推荐 Skills