slack

SUSPICIOUS. The skill's Slack access capabilities mostly match its stated purpose and its installs come from legitimate sources, but its authentication model is unusually invasive: it extracts browser session tokens/cookies, stores them locally, and replays them through helper scripts instead of using standard Slack app auth. Data flows stay on official Slack endpoints, so this is not confirmed malware, but the credential handling and persistent session capture create elevated security risk disproportionate to a typical API integration.

This is a browser automation CLI, not evidently malware. Its caller-controlled JavaScript execution and URL navigation are powerful by design. Unvalidated session IDs create a filesystem path traversal/deletion risk, and saved browser storage state contains sensitive authentication data. Treat it as trusted-only tooling and validate session IDs and inputs before exposing it to untrusted callers.

The wrapper has a significant code-injection risk in browser mode because command-line input is interpolated into JavaScript executed in the authenticated Slack browser context. Sourcing configuration and token files also executes shell code. These issues do not by themselves establish malicious intent; protect inputs and ensure the sourced files are trusted.

The code collects live Slack session credentials from Chrome and stores them locally in plaintext. This could support a legitimate integration, and no exfiltration is present in the fragment, but it creates a significant credential-exposure risk. Review the script's authorization and protect tokens.env with restrictive permissions; assess the uvx fallback's package provenance before use.