Slack Hub Skill

Send messages, reply in threads, search workspace content, and list public channels using Slack Bot integration with rate-limit handling.

This skill implements Slack messaging/search and needs a SLACK_BOT_TOKEN, but the package metadata doesn't declare that requirement and there are a few inconsistencies you should resolve before installing: - Confirm the SLACK_BOT_TOKEN: the code reads SLACK_BOT_TOKEN from the environment. Only provide a token with the minimal scopes required (e.g., chat:write, search:read, channels:read) and avoid full admin tokens. Understand that a token with broad scopes can read private channels and post messages. - .env vs environment: SKILL.md asks you to put the token in a .env file, but the code doesn't load .env. Ensure your runtime will load that file (or set the env var securely in the agent environment) rather than leaving secrets in an unprotected file. - Dependency/install: skill.json lists 'requests' but there is no install spec. Make sure the runtime includes the requests package or install it in an isolated environment before use. - Claims vs implementation: SKILL.md claims rate-limit handling and threading support; the code does not implement explicit rate-limit backoff logic and threading is only included insofar as chat.postMessage accepts thread_ts. Ask the author to clarify or update the code/README. - Review token scopes and audit: inspect or run the code in an isolated environment (or read the source, which appears to call only slack.com endpoints) and verify no external endpoints aside from slack.com are used. If you proceed, rotate the bot token afterward and monitor Slack app activity/logs. If the author can correct the metadata (declare SLACK_BOT_TOKEN as a required credential), add clear install steps for dependencies, and either implement or remove the claimed rate-limit handling, this package would be internally coherent. Until then, treat it as suspicious and verify details before granting it a production token.

Type: OpenClaw Skill Name: slack-hub-skill Version: 0.1.0 The OpenClaw skill bundle for Slack integration is classified as benign. All files, including `SKILL.md`, `slack_hub.py`, and `skill.json`, align with the stated purpose of providing Slack messaging and search capabilities. The `slack_hub.py` script correctly retrieves the `SLACK_BOT_TOKEN` from environment variables and makes network requests exclusively to the official Slack API (https://slack.com/api). The `skill.json` file explicitly declares the necessary 'network' and 'env_vars' permissions, which are justified by the code's functionality. There is no evidence of prompt injection attempts in `SKILL.md`, unauthorized data exfiltration, malicious execution, persistence mechanisms, or obfuscation.