| name | slack-inspector-expert |
| description | Interpret slack-inspector findings, explain Slack API coverage limits, and turn Slack workspace posture results into control evidence or remediation. |
| license | MIT |
Slack Inspector Expert
Use this skill when reviewing output from slack-inspector or planning remediation for Slack workspace security.
Output Shape
slack-inspector writes Finding schema v1 documents to:
~/.cache/claude-grc/findings/slack-inspector/<run_id>.json
Each run emits a workspace-level slack_workspace resource with SCF evaluations for:
IAC-02: MFA / 2FA evidenceIAC-04: SSO and session-duration evidenceDCH-07: message and file retention visibilityTPM-03: app approval workflow visibilityDLP-01: DLP or discovery visibilityGOV-03: workspace metadata inventory
Coverage Limits
Slack exposes many workspace governance controls only through Enterprise Grid or admin-scoped APIs. Treat inconclusive as a coverage signal, not as a pass:
missing_scope, not_allowed_token_type, or not_authed: request an admin-approved token with the listed scope.feature_not_enabled or enterprise_required: verify manually in Slack Enterprise Admin settings or document plan limitations.channel_not_found on retention checks: configure a representative channel for retention policy sampling.
Review Guidance
- Prefer SCF control IDs already present in the finding.
- Do not claim Slack-wide 2FA, SSO, retention, app approvals, or DLP are compliant from a bot-token-only run.
- For audit evidence, pair collector output with Slack admin screenshots or exported policy records when the API returns inconclusive.
Remediation Patterns
- Require 2FA for all users, especially workspace owners and admins.
- Enforce SSO and appropriate session duration through Enterprise settings.
- Enable app approval workflows and periodically review approved applications.
- Define retention rules for messages and files according to legal and compliance requirements.
- Enable DLP or discovery integrations where regulated data may appear in Slack.
