Slack Thread Export

Export Slack thread messages from a logged-in Slack web tab into CSV using an attached Chrome Browser Relay tab. Use when the user wants to collect Slack con...

This skill legitimately needs to run inside a logged-in Slack browser tab and reads the Slack web client's localStorage to get the in-page token before issuing in-page fetch calls — that is how it works, but it also means the skill can access sensitive session state. Before installing or running: (1) Review the provided Python scripts and SKILL.md (you already have them) to confirm no unexpected network calls or hidden exfiltration; (2) only attach a browser tab you trust and avoid attaching tabs containing unrelated accounts or highly sensitive sessions; (3) prefer small, narrow exports (channel/date whitelist and --preflight) to reduce risk of accidental broad data export; (4) ensure the 'openclaw' binary used by the scripts is trusted on your system; (5) if you have low tolerance for exposing in-page tokens to third-party code, do not use this skill — instead use an admin API or a vetted tool that uses scoped tokens. The behavior is coherent with the stated purpose, but reading page-local tokens is sensitive, so proceed only if you trust the skill and environment.

Type: OpenClaw Skill Name: slack-thread-export Version: 0.2.0 The skill automates the extraction of Slack messages and internal 'xoxc' tokens from a logged-in browser session by executing JavaScript in the page context via 'openclaw browser evaluate' in scripts/export_slack_threads.py. While the stated goal in SKILL.md is data export for the user, the programmatic access to private communications and internal session tokens represents a high-risk capability. No evidence of external data exfiltration was found, but the mechanism of piggybacking on active browser sessions to query internal APIs is a technique often associated with session data theft.