connector-slack
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a Slack connector following platform-specific security best practices for the Internet Computer (IC).
- [SAFE]: Sensitive Slack tokens (xoxb- or xoxp-) are managed through an admin-gated setter (
setSlackToken) protected by a permission check (AccessControl.hasPermission). This prevents unauthorized users from accessing or overwriting credentials. - [SAFE]: The skill correctly mandates the use of
is_replicated = ?falsefor all Slack API outcalls. This is a critical security measure that prevents the bearer token from being sent by every node in the subnet, thereby minimizing the risk of credential leakage and preventing duplicate API calls. - [EXTERNAL_DOWNLOADS]: The skill references standard Motoko packages (
slack-clientandcaffeineai-authorization) from the Mops registry, which are necessary for its documented functionality.
Audit Metadata