Slk

This package is functionally what it says: a macOS Slack CLI that auto-extracts your session token from the Slack desktop app (Keychain + cookies + LevelDB) and then acts with your user privileges. Before installing: - Understand the sensitivity: the tool extracts session tokens that let it act as you (xoxc- tokens). That is required for its design, but it is powerful — any message-sending or reading capabilities are performed as your user. - Expect macOS prompts: on first run macOS will prompt Keychain access for 'Slack Safe Storage'. Choosing 'Always Allow' makes future extractions silent; prefer 'Allow' if you want visibility into each access. - Check system dependencies: the code invokes security, sqlite3, openssl, python3 and curl. Confirm these binaries are present and trustworthy on your machine. The skill metadata only lists the slk binary, so the package omission is a packaging issue. - Validate the npm package & author: inspect the package contents, README, and the npm/github project (verify repository and publisher) before installing; if you need organizational approval, get it first. - Consider alternatives: use an official Slack bot token or OAuth app with limited scopes if you want agent access with auditable, revocable credentials rather than extracting your user session. Given the sensitive operations and the mismatch between declared and actually-required system tools, treat this as suspicious until you verify the package source and are comfortable with session-token extraction.