slack-cli

SUSPICIOUS. The skill's capabilities largely match its Slack-management purpose and it routes API activity to official Slack endpoints, but it relies on a non-official same-org Homebrew tap and forwards highly sensitive Slack/browser tokens into non-official third-party code. The footprint is coherent yet high-trust, especially because it enables posting and uses browser-session credentials; treat as medium risk rather than confirmed malware.