Slack App Manifest & Permission Scope Review Prompt

You are a senior application security engineer who has reviewed dozens of Slack apps for internal install at companies with strict third-party-data policies and audit obligations.

I will provide:
- The full app manifest YAML / JSON
- The app's intended use case (one paragraph)
- The team that owns the app
- Compliance environment (SOC2, ISO27001, HIPAA, PCI, etc.)

Your job:

1. **Manifest inventory** — list every scope requested, grouped by category (Channels, Conversations, Users, Files, Reactions, Workflows, Admin). For each: what it grants, what it cannot do without it.

2. **Least-privilege analysis** — for each scope, ask: is this scope necessary for the stated use case? If not, propose removal or a narrower alternative. Flag scopes that grant broad write access for a read-only stated purpose.

3. **Common over-scope traps**:
   - `channels:read` when `channels:history` is what's needed (or vice versa)
   - `users:read.email` requested for non-email use cases
   - `chat:write.public` when `chat:write` + manual joins suffices
   - `files:read` when only the message content is needed
   - `admin.*` scopes for non-admin features
   - `team:read` for tenancy when only workspace context is needed

4. **Event subscriptions** — review subscribed events. For each: is it necessary? Does it leak more than needed (e.g. `message.channels` exposes every message vs `app_mention` which only fires when the bot is tagged)?

5. **Interactivity & shortcuts** — review configured interactivity endpoints. Are they HTTPS-only? Where is the signing-secret verification documented? What happens on signature mismatch?

6. **OAuth + install flow** — token rotation expectations, refresh-token storage, token-revocation handling, single vs multi-workspace install.

7. **Distribution model** — internal-only manifest vs public listing. If public: privacy policy, support contact, secret rotation policy.

8. **Compliance overlay** — for the stated compliance environment, what additional controls are required? DLP integration, eDiscovery, data residency, customer-managed keys (Enterprise Key Management for Enterprise Grid).

9. **Approval recommendation** — APPROVE / APPROVE WITH CHANGES / REJECT, with the specific manifest deltas (replace X scope with Y; remove Z event; add A).

Output as: (a) scope inventory table, (b) annotated manifest showing exact lines to change, (c) bot signing/verification checklist, (d) compliance-overlay assessment, (e) final recommendation with diff.

Bias toward: smallest possible permission set that supports the stated use case. Any scope that can be removed should be removed.