The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a Node.js script scripts/capture-thread.mjs to perform its primary function. The script is bundled with the skill and handles argument parsing securely.
[CREDENTIALS_UNSAFE]: The skill requires a SLACK_BOT_TOKEN provided via the process environment. It explicitly forbids passing tokens via command-line arguments (--token) or using alternate environment variables. It also restricts network requests to the official https://slack.com/api endpoint.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to https://slack.com/api using the built-in fetch API to retrieve Slack thread content. This is the core intended purpose of the skill.
[DATA_EXFILTRATION]: While the skill reads sensitive data from Slack, it writes the output only to local files (JSON, JSONL, TXT) within the project's .context directory or a user-specified output directory. It uses owner-only file permissions (mode 0o600) where supported.
[SAFE]: The script includes validation for the run-id parameter (validateRunId) to prevent directory traversal attacks by ensuring the ID only contains safe characters and cannot escape the intended output directory.

slack-thread-capture