A Flask route that answers Slack's url_verification challenge but never checks X-Slack-Signature accepts fake events and button clicks from anyone who finds the URL, and one signatureVerification: false in a Bolt app does the same. This skill finds those and eleven other Slack app mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on JavaScript, TypeScript and Python files that use Slack (Bolt, slack_sdk, @slack/web-api, Slack tokens, URLs, headers or request fields only Slack sends), on Slack app manifests in JSON or YAML, and on env, config and CI files for tokens and webhook URLs. It knows Bolt's defaults (the signature check is on unless you turn it off, Socket Mode needs none), the verification helpers in slack_sdk and @slack/bolt, edge frameworks that verify by default, and when a check may live in middleware, a hook, a decorator or a helper it cannot read (then it says REVIEW, not BLOCK). It reads .gitignore, so a token in a .env file that git ignores is counted in one line instead of reported. Placeholders from Slack's docs are ignored, comments and test files are skipped, and nothing is run or sent to Slack. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Tokens, secrets and webhook URLs are never printed.

What it checks

BLOCK (fix before shipping)

• K01: Slack tokens (xoxb, xoxp, xapp, rotating and refresh tokens) in code, manifests, env, config or CI files git would commit
• K02: signing secrets, client secrets or verification tokens written as literals or literal fallbacks in code
• K03: incoming webhook or workflow webhook URLs in code, env, config or CI files git would commit
• K04: a whole-server file that handles Slack events, slash commands or interactivity with nothing that could check X-Slack-Signature
• K05: Bolt's signature check turned off (signatureVerification: false, request_verification_enabled=False) outside Socket Mode

REVIEW (check before release)

• K11: a hand-made signature check with no five-minute timestamp limit
• K12: a hand-made signature check that compares with == instead of a constant-time function
• K13: a Slack request handler whose signature check, if any, lives in middleware, hooks, decorators, helpers or files the scan cannot read
• K14: handlers that trust the deprecated verification token
• K15: admin scopes and user-token history or search scopes (also optional scopes) in manifests and OAuth settings
• K16: http (not https) OAuth redirect, Events, interactivity and slash command URLs
• K17: @channel, @here or @everyone messages, or link_names, whose call carries user or request text
• K18: OAuth state verification turned off or the state secret written in the code

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and Slack documentation link for each rule
• A risky and a safe example Slack app (Bolt app, manifest, Flask service and Express routes), and the real report the scanner produces on the risky one

Limits

It reads each file as written: settings made in Slack's app configuration pages, values from environment variables or other modules, and what middleware or helpers in other files actually do are not seen. A handler that never names Slack is not checked. Only JavaScript, TypeScript and Python code is read; Bolt for Java and apps in Go, Ruby or PHP are not checked. Env, config and CI files are read for tokens and webhook URLs only. One finding is shown per rule and line. Test files are skipped. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 24 files: SKILL.md, the scanner in scripts/ (7 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (14 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.