slack-inspector-expert

Slack Inspector Expert

Use this skill when reviewing output from slack-inspector or planning remediation for Slack workspace security.

Output Shape

slack-inspector writes Finding schema v1 documents to:

~/.cache/claude-grc/findings/slack-inspector/<run_id>.json

Each run emits a workspace-level slack_workspace resource with SCF evaluations for:

• IAC-02: MFA / 2FA evidence
• IAC-04: SSO and session-duration evidence
• DCH-07: message and file retention visibility
• TPM-03: app approval workflow visibility
• DLP-01: DLP or discovery visibility
• GOV-03: workspace metadata inventory

Coverage Limits

Slack exposes many workspace governance controls only through Enterprise Grid or admin-scoped APIs. Treat inconclusive as a coverage signal, not as a pass:

• missing_scope, not_allowed_token_type, or not_authed: request an admin-approved token with the listed scope.
• feature_not_enabled or enterprise_required: verify manually in Slack Enterprise Admin settings or document plan limitations.
• channel_not_found on retention checks: configure a representative channel for retention policy sampling.

Review Guidance

• Prefer SCF control IDs already present in the finding.
• Do not claim Slack-wide 2FA, SSO, retention, app approvals, or DLP are compliant from a bot-token-only run.
• For audit evidence, pair collector output with Slack admin screenshots or exported policy records when the API returns inconclusive.

Remediation Patterns

• Require 2FA for all users, especially workspace owners and admins.
• Enforce SSO and appropriate session duration through Enterprise settings.
• Enable app approval workflows and periodically review approved applications.
• Define retention rules for messages and files according to legal and compliance requirements.
• Enable DLP or discovery integrations where regulated data may appear in Slack.