Slack Me module

[bpmct]

A discussion dedicated to the Slack Me module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	12 / 20	2 / 2 (N/A: 18)	7 / 10	66 / 100

Drilldown

Track: Utility (simple Slack-notification helper; not an agent CLI or IDE)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	Module has only one meaningful configurable knob (slack_message); README shows both the default basic invocation and a "Custom Slack Message" example demonstrating $COMMAND/$DURATION substitution — adequately covers the module's small configuration surface.
Visual preview	5	0	No image, GIF, or video embedded in the README — only a Slack icon reference in frontmatter.

Credential Hygiene — 12 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	8	No module variables carry actual secrets (auth is delegated to Coder's external-auth system), but the setup instructions inline a placeholder CODER_EXTERNAL_AUTH_1_CLIENT_SECRET="<your client secret>", which per calibration caps this criterion at half.
Non-hardcoded auth path	4	4	Uses Coder's external auth provider (auth_provider_id) and coder external-auth access-token inside slackme.sh — a documented OAuth-based path that avoids pasting raw keys into the template.

Restricted-Environment Readiness — 2 / 2 (N/A: 18)

Criterion	Max	Score	Notes
Mirrorable artifact source	5	N/A	Module installs nothing — it only writes an inline shell script (slackme.sh) via templatefile; no tool binary is downloaded, so no URL override applies.
Bring-your-own binary	10	N/A	No binary/tool is fetched by the module, so there is nothing to disable or bypass.
Egress transparency	3	N/A	No install-time download exists; grouped as N/A per the "downloads nothing of its own" rule alongside the other artifact criteria.
Runs without sudo	2	2	coder_script and slackme.sh use only cat, chmod, curl, and the coder CLI — no sudo invocations anywhere; script runs fine unprivileged.

Engineering Quality — 7 / 10

Criterion	Max	Score	Notes
Input quality	6	3	All three variables (agent_id, auth_provider_id, slack_message) have clear descriptions and slack_message has a sensible default, but there is no validation block anywhere despite several candidate checks (e.g., format of auth_provider_id or message placeholders).
Test coverage	4	4	main.test.ts is a thorough TypeScript end-to-end suite: install script execution, PATH placement, usage output, auth-failure handling, and message-formatting/duration logic across multiple time scales.

Overall — 66 / 100

Raw 31 / 47 → round(31 / 47 × 100) = 66

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.