users_profile_get_extras

What users_profile_get_extras does on Slack

AI agents call users_profile_get_extras to retrieve information from Slack without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why users_profile_get_extras is rated Low

This tool appears to retrieve user profile data (a read operation with no side effects). However, the empty description creates uncertainty about what 'extras' encompasses—it could potentially include sensitive profile fields like email, phone, or custom fields. In a Slack context where user profiles may contain PII, unauthorized retrieval poses privacy risks, warranting medium severity despite the read-only nature.

From the tool's definition Tool name 'users_profile_get_extras' contains 'get' which indicates data retrieval. Tool description is empty, limiting ability to confirm exact scope. The 'users_profile' prefix suggests it retrieves user profile information from Slack.

The rule that runs users_profile_get_extras safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Slack, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For users_profile_get_extras, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "users_profile_get_extras": {}
  }
}

Questions about users_profile_get_extras