Latest release: v2026.5.28Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The package is an official @openclaw Slack channel plugin for Slack messages, DMs, commands, setup, files, reactions, and app events; Slack API tokens, workspace member/channel reads, and message writes are purpose-aligned for that role.
Instruction Scope
The runtime behavior is tied to Slack setup and channel operations, with configuration controls for allowlists, native commands, exec approvals, and user-token read-only behavior; account inspection and live directory lookup expose sensitive internal data paths that should remain host-controlled.
Install Mechanism
The npm package metadata shows a normal OpenClaw plugin package with Slack SDK dependencies and no package lifecycle install scripts; VirusTotal and static scan telemetry are clean.
Credentials
Reading SLACK_BOT_TOKEN, SLACK_APP_TOKEN, and optional SLACK_USER_TOKEN is expected for Slack integration, but these credentials can carry broad workspace authority and should be least-privilege and rotated as needed.
Persistence & Privilege
No unrelated OS persistence or privilege escalation was found; the plugin uses bounded runtime caches/stores for thread participation and delivery state, and setup/config writes appear scoped to Slack channel configuration.
Scan Findings in Context
[SQP-2] expected: The account inspection code does return resolved Slack token values, which is sensitive but appears to be internal setup/diagnostic plumbing rather than exfiltration; consumers should avoid logging or displaying these values.
[SQP-2] expected: The live directory code enumerates Slack users and channels for directory/search resolution, which fits the Slack connector purpose, but workspace admins should understand that this may include profile fields and private-channel metadata available to the configured token.
Assessment
Install only in workspaces where you trust OpenClaw to act as a Slack app. Use the narrowest Slack scopes that still support your workflows, prefer bot tokens over user tokens, keep user-token write access disabled unless needed, configure allowlists for DMs and commands, and treat any setup/account inspection output as secret-bearing.