slack-agent
Pass
Audited by Gen Agent Trust Hub on Jul 16, 2026
Risk Level: SAFE
Full Analysis
- Secret Management Guidance: The skill emphasizes secure development by instructing users to store credentials in
.envfiles, ensuring they are included in.gitignore, and recommending against hardcoding sensitive tokens likeSLACK_BOT_TOKENorSLACK_SIGNING_SECRET. - Trusted Infrastructure Integration: It integrates with well-known and trusted services including Vercel for deployment, Slack for messaging infrastructure, and Upstash for Redis state management. The recommendation to use Vercel AI Gateway provides a more secure path for AI integration as it can use OIDC tokens instead of manual API keys.
- Quality and Security Standards: The skill includes mandatory quality checks, such as linting with Biome and automated unit testing with Vitest. It provides educational guidance on protecting cron endpoints with a
CRON_SECRETand using Vercel's OIDC mechanism for AWS credentials instead of long-lived access keys. - Interactive Setup Wizard: The multi-phase setup wizard is designed to guide the user through a structured development process. It includes a specific approval phase (Phase 1b) for the implementation plan before code is scaffolded, ensuring the developer retains control over the generated project structure.
- Slack-Specific Security Patterns: The skill documents framework-specific security requirements, such as signature verification for Slack webhooks and handling H3 stream issues to ensure request integrity in Bolt-based projects.
Audit Metadata