What the reviewer found
A Slack bridge command with an explicit prompt-injection defense section (the P6 line is an example probe to ignore, not an instruction to comply with) and a hard refusal list for secrets/tokens (the PE3 hit) that the agent must never surface. The E1/NET curl calls go through a local bridge that holds the Slack token and posts to Slack's own API, which is the tool's stated purpose, flagged low since it does move files to an external service (Slack).
network— calls the vendor’s API
What was read
The file as it ships in surajpratap/claude-wow-plugin:
commands/slacker.md
What the static scan said
The scan flagged 5things. The reviewer kept 0 and dismissed 5 as false.
P6Asks the agent to reveal its instructions — false positiveE1Sends data to an external URL — false positivePE2Asks for root — false positivePE3Reaches for credential files — false positiveNETMakes network calls — false positive
How this review was made
Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.