Claude Code + Slack: How an AI Agent Integration Becomes a Compromise Path

This report demonstrates a proof-of-concept attack where a malicious Claude Code "skill" is used to hijack a trusted Slack integration, send phishing links across channels and DMs, and potentially behave like an AI-driven worm that exfiltrates data and propagates through connected integrations. The write-up covers skill manipulation techniques (guidelines, Definition of Done, fallback behavior), an execution timeline, detection gaps (Slack audit logs, EDR/SIEM limitations), and practical defenses including logging, least-privilege MCP scopes, human review policies, and sandboxing.