Slk

Read, send, search, and manage Slack messages and DMs via the slk CLI. Use when the user asks to check Slack, read channels or DMs, send Slack messages, search Slack, check unreads, manage drafts, view saved items, or interact with Slack workspace. Also use for heartbeat Slack checks. Triggers on "check slack", "any slack messages", "send on slack", "slack unreads", "search slack", "slack threads", "draft on slack", "read slack dms", "message on slack".

This package is functionally what it says: a macOS Slack CLI that auto-extracts your session token from the Slack desktop app (Keychain + cookies + LevelDB) and then acts with your user privileges. Before installing: - Understand the sensitivity: the tool extracts session tokens that let it act as you (xoxc- tokens). That is required for its design, but it is powerful — any message-sending or reading capabilities are performed as your user. - Expect macOS prompts: on first run macOS will prompt Keychain access for 'Slack Safe Storage'. Choosing 'Always Allow' makes future extractions silent; prefer 'Allow' if you want visibility into each access. - Check system dependencies: the code invokes security, sqlite3, openssl, python3 and curl. Confirm these binaries are present and trustworthy on your machine. The skill metadata only lists the slk binary, so the package omission is a packaging issue. - Validate the npm package & author: inspect the package contents, README, and the npm/github project (verify repository and publisher) before installing; if you need organizational approval, get it first. - Consider alternatives: use an official Slack bot token or OAuth app with limited scopes if you want agent access with auditable, revocable credentials rather than extracting your user session. Given the sensitive operations and the mismatch between declared and actually-required system tools, treat this as suspicious until you verify the package source and are comfortable with session-token extraction.

Type: OpenClaw Skill Name: slack-personal Version: 0.1.7 The skill is classified as suspicious due to its transparent but high-risk method of extracting Slack session credentials (xoxc- token and xoxd- cookie) from the macOS Keychain, Slack's LevelDB, and SQLite databases. This involves executing system commands like `security`, `sqlite3`, `openssl`, `python3`, and `curl` via `child_process.execSync` and `child_process.spawnSync` in `src/auth.js`. While the code's intent is to enable a legitimate Slack CLI for the local user and it explicitly warns about the security implications of 'Always Allow' for Keychain access in `README.md` and `SKILL.md`, the powerful system interactions for credential access represent a significant attack surface and potential vulnerability if the tool were compromised or misused. There is no evidence of intentional data exfiltration to unauthorized endpoints, persistence mechanisms, or malicious prompt injection against the AI agent in the documentation.