The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill extracts Slack session tokens (xoxc and xoxd) from the user's Google Chrome profile on macOS. This involves querying the macOS Keychain for the 'Chrome Safe Storage' password to decrypt the cookie database.
[COMMAND_EXECUTION]: Uses AppleScript (osascript) to inject and execute JavaScript into active Google Chrome tabs to harvest tokens from the application's local storage.
[EXTERNAL_DOWNLOADS]: The skill automatically installs external components, including the Playwright Chromium browser binary (~150 MB) via npm/npx and the pycookiecheat library from PyPI via uvx.
[DYNAMIC_EXECUTION]: Includes a bridge script that uses Playwright's page.evaluate() to execute dynamically generated JavaScript snippets within a browser session. This allows arbitrary code execution in the context of the Slack web application.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Slack messages without sanitization, creating a surface for indirect prompt injection. 1. Ingestion points: Slack channel history and thread replies fetched via the conversations.history and conversations.replies API methods. 2. Boundary markers: No delimiters or instructions to ignore embedded commands are present in the processing logic. 3. Capability inventory: The skill can post/edit messages, add reactions, pin items, interact with the Slack UI via Playwright, and write to local configuration files in ~/.agents/config/slack/. 4. Sanitization: External message content is not sanitized or escaped before being presented to the agent context.

slack