slack-cli
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill contains a fallback installation procedure that downloads a setup script from Slack's official content delivery network (
downloads.slack-edge.com). This is a legitimate vendor resource used for distribution of the Slack CLI. - [REMOTE_CODE_EXECUTION]: The installation command uses a piped-to-shell pattern (
curl -fsSL ... | bash) to execute the remote install script. While this is a high-capability execution pattern, it is directed at a verified vendor domain belonging to the skill's authoring organization. - [COMMAND_EXECUTION]: The skill performs extensive interaction with the
slackCLI, including project management, authentication, and API calls. It implements a defensive check using a command fingerprint (MD5 hash of an empty output) to verify that the tool on the system PATH is the expected public CLI before execution.
Audit Metadata