/slack-inspector-expert

name: slack-inspector-expert
description: Interpret slack-inspector findings, explain Slack API coverage limits, and turn Slack workspace posture results into control evidence or remediation.
license: MIT

Slack Inspector Expert

Use this skill when reviewing output from `slack-inspector` or planning remediation for Slack workspace security.

Output Shape

`slack-inspector` writes Finding schema v1 documents to:

~/.cache/claude-grc/findings/slack-inspector/<run_id>.json

Each run emits a workspace-level `slack_workspace` resource with SCF evaluations for:

• `IAC-02`: MFA / 2FA evidence
• `IAC-04`: SSO and session-duration evidence
• `DCH-07`: message and file retention visibility
• `TPM-03`: app approval workflow visibility
• `DLP-01`: DLP or discovery visibility
• `GOV-03`: workspace metadata inventory

Coverage Limits

Slack exposes many workspace governance controls only through Enterprise Grid or admin-scoped APIs. Treat `inconclusive` as a coverage signal, not as a pass:

• `missing_scope`, `not_allowed_token_type`, or `not_authed`: request an admin-approved token with the listed scope.
• `feature_not_enabled` or `enterprise_required`: verify manually in Slack Enterprise Admin settings or document plan limitations.
• `channel_not_found` on retention checks: configure a representative channel for retention policy sampling.

Review Guidance

• Prefer SCF control IDs already present in the finding.
• Do not claim Slack-wide 2FA, SSO, retention, app approvals, or DLP are compliant from a bot-token-only run.
• For audit evidence, pair collector output with Slack admin screenshots or exported policy records when the API returns inconclusive.

Remediation Patterns

• Require 2FA for all users, especially workspace owners and admins.
• Enforce SSO and appropriate session duration through Enterprise settings.
• Enable app approval workflows and periodically review approved applications.
• Define retention rules for messages and files according to legal and compliance requirements.
• Enable DLP or discovery integrations where regulated data may appear in Slack.