Security audit

Slk

Security checks across malware telemetry and agentic risk

Overview

This Slack skill is transparent about its design, but it reuses and caches your desktop Slack login so an agent can read and act in Slack as you.

Install only if you intentionally want an agent-capable macOS Slack CLI that uses your logged-in desktop Slack session. Prefer one-time Keychain Allow over Always Allow, use it only on a trusted personal machine, understand it can access DMs/private channels and post as you, and delete ~/.local/slk/token-cache.json if you want to clear the cached Slack token.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares itself user-invocable and operationally uses shell, file access, network access, and local environment capabilities, but it does not declare permissions or surface those powers explicitly. This reduces informed consent and prevents policy gating around sensitive operations such as local credential retrieval and outbound Slack actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s top-level description frames it as a normal Slack messaging utility, but the body reveals automatic extraction of Slack session credentials from local LevelDB and macOS Keychain, plus local token caching. That mismatch is dangerous because users may invoke the skill expecting ordinary Slack access without realizing it performs credential recovery and persistence from local secret stores.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation explicitly states that `src/auth.js` performs credential extraction from the macOS Keychain and Slack local LevelDB data. For a skill framed as reading and sending Slack messages, silently harvesting desktop session material is a sensitive access capability that materially expands privilege and bypasses normal explicit OAuth or bot-based consent flows.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The Auth section says the tool auto-extracts `xoxc-` tokens and `xoxd-` cookies from the local Slack desktop app and caches them on disk. Those are highly sensitive session credentials; obtaining and storing them from another application can enable full account actions as the user and is not transparently justified by the skill description.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill advertises a normal Slack integration but the README documents a materially different and more sensitive mechanism: extracting session credentials from the local Slack app, Keychain, cookies, and LevelDB. That omission prevents informed consent and can cause an agent operator to grant a skill credential-harvesting capability they did not reasonably expect.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documented design directly accesses macOS Keychain, decrypts Slack cookies, and extracts xoxc session tokens from local app storage to impersonate the logged-in user. In an agent context, this is dangerous because it enables broad message access and message sending without scoped OAuth consent, and the recovered credentials may be abused by any code the agent runs.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file’s own header states it extracts Slack session credentials from macOS Keychain, cookies, and LevelDB rather than using the advertised Slack CLI workflow. That is a strong capability mismatch and indicates covert credential harvesting beyond the skill’s stated purpose of reading and sending Slack messages.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This code actively retrieves the 'Slack Safe Storage' secret from Keychain, decrypts Slack cookies, and derives session material to impersonate the user. Harvesting local application credentials is highly sensitive and unjustified for a messaging skill, enabling account takeover and unauthorized workspace access.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code invokes openssl, curl, sqlite3, and an embedded Python script to mine Slack tokens from local storage and validate them against Slack. Combining multiple external tools to discover and test bearer tokens demonstrates deliberate credential collection and increases the attack surface for abuse.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The file implements a `react()` capability that can modify Slack state by adding emoji reactions, but the manifest description only advertises reading, sending, searching, and managing messages/DMs. This is a scope mismatch that can enable unintended actions through the skill without the user's or platform's clear awareness, which is especially relevant for agent tools that rely on manifest-declared capabilities for trust and review.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: The `users()` command exposes workspace directory enumeration, including names, display names, user IDs, and status text, but that capability is not clearly disclosed in the manifest description. Undeclared identity enumeration broadens the data-access surface of the skill and can facilitate privacy leakage or reconnaissance inside a Slack workspace.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly instructs writing the npm publish token into a plaintext `.npmrc` file. Although it removes the file afterward, this pattern still risks credential exposure through filesystem backups, shell history, accidental commits, process inspection, or interruption before cleanup. In the context of an agent skill or automation workflow, this is more dangerous because agents may follow the command non-interactively and create sensitive files without surfacing the risk to the user.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The publish step writes `NPM_PUBLISH_TOKEN` directly into a project-local `.npmrc` and relies on a later cleanup command. If publishing fails or the command sequence is interrupted, the token may remain on disk and could be committed, read by other local processes, or exposed through mishandling.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The README foregrounds convenience and zero setup but does not prominently warn that the tool reads and sends workspace messages as the logged-in user by extracting local session material. That weak disclosure increases the chance that users deploy the skill in sensitive workspaces without understanding the privacy, authorization, and policy implications.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The invocation wording is broad enough to trigger on many generic Slack-related requests, increasing the chance the skill is selected automatically in contexts where the user did not intend credential-backed workspace access. Because this skill can read DMs, search workspace history, and send messages as the user, over-broad triggering materially raises misuse and accidental data exposure risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The top-level skill description does not warn that authentication is achieved by extracting credentials from the local Slack app and macOS Keychain. Omitting that warning undermines informed consent for a highly sensitive behavior involving recovery and decryption of session material.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The CLI explicitly advertises automatic Slack credential access from the desktop app and exposes write-capable operations such as send, react, and draft creation/deletion without a clear safety warning or confirmation boundary. In an agent-skill context, this increases the chance of unintended state-changing actions against a user's Slack workspace, especially because authentication is implicit and write commands are easy to invoke.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill extracts, caches, and transmits Slack credentials without any user-facing notice, confirmation, or informed consent. In the context of a Slack assistant skill, hidden acquisition and reuse of session secrets is especially dangerous because it silently grants persistent access to private messages and workspace resources.

Credential Access

High

Category: Privilege Escalation
Content: 6. Update `SKILL.md` (commands list) 7. `npm version patch --no-git-tag-version` 8. `git add -A && git commit -m "feat: ..." && git push` 9. `echo "//registry.npmjs.org/:_authToken=${NPM_PUBLISH_TOKEN}" > .npmrc && npm publish && rm .npmrc` 10. `cp SKILL.md ~/moltbot/skills/slk/SKILL.md` ## Testing
Confidence: 89% confidence
Finding: This is effectively the same underlying issue as the other line-25 PE3 finding: a publish credential is written to a local config file in the working directory. Duplicated static findings aside, the credential handling pattern is risky because token exposure can lead to unauthorized package publication or takeover activity.

Credential Access

High

Category: Privilege Escalation
Content: 6. Update `SKILL.md` (commands list) 7. `npm version patch --no-git-tag-version` 8. `git add -A && git commit -m "feat: ..." && git push` 9. `echo "//registry.npmjs.org/:_authToken=${NPM_PUBLISH_TOKEN}" > .npmrc && npm publish && rm .npmrc` 10. `cp SKILL.md ~/moltbot/skills/slk/SKILL.md` ## Testing
Confidence: 89% confidence
Finding: This is effectively the same underlying issue as the other line-25 PE3 finding: a publish credential is written to a local config file in the working directory. Duplicated static findings aside, the credential handling pattern is risky because token exposure can lead to unauthorized package publication or takeover activity.

Credential Access

High

Category: Privilege Escalation
Content: - `src/commands.js` — All command logic. Add new commands here. - `src/api.js` — `slackApi()` and `slackPaginate()`. Add POST endpoints to `writeMethods` array. - `src/auth.js` — Keychain + LevelDB credential extraction. Rarely needs changes. - `src/drafts.js` — Draft commands (create/list/drop). - `bin/slk.js` — CLI entry point. Command routing + help text.
Confidence: 98% confidence
Finding: The mention of `Keychain + LevelDB credential extraction` indicates the tool is designed to access stored authentication material from the host system. That is a credential-access behavior with strong account-compromise implications, especially in a skill whose stated purpose is normal Slack interaction rather than forensic recovery or authorized credential management.

Credential Access

High

Category: Privilege Escalation
Content: `slk` uses the credentials already stored by the Slack desktop app. No OAuth flows, no manual token management. ### Keychain access prompt On first run, macOS will show a Keychain dialog asking whether to allow access to "Slack Safe Storage":
Confidence: 97% confidence
Finding: This section states that the tool uses credentials already stored by the Slack desktop app rather than an explicit OAuth flow. In an agent skill, that means the tool relies on local credential reuse and can grant the agent access equivalent to the user's Slack session, which is highly sensitive.

Credential Access

High

Category: Privilege Escalation
Content: ### Keychain access prompt On first run, macOS will show a Keychain dialog asking whether to allow access to "Slack Safe Storage": - **Allow** — grants one-time access. You'll be prompted again next time slk needs to decrypt the cookie. - **Always Allow** — grants permanent access for this binary. No future prompts.
Confidence: 96% confidence
Finding: The Keychain prompt discussion confirms the tool requests access to 'Slack Safe Storage' so it can decrypt Slack session material. If a user selects 'Always Allow,' subsequent agent or script executions can silently retrieve the key and access Slack as the user, weakening the local security boundary.

Credential Access

High

Category: Privilege Escalation
Content: ### How it works 1. **Cookie decryption** — Reads the encrypted `d` cookie from Slack's SQLite cookie store (`Cookies` file). Decrypts it using the "Slack Safe Storage" key from the macOS Keychain via PBKDF2 + AES-128-CBC. Supports both direct-download and Mac App Store keychain account names. 2. **Token extraction** — Scans Slack's LevelDB storage (`Local Storage/leveldb/`) for `xoxc-` session tokens. Uses both direct regex scanning and a Python fallback for Snappy-compressed entries. The Slack data directory is auto-detected (direct download or App Store sandbox).
Confidence: 99% confidence
Finding: The same passage also indicates direct access to keychain-protected secrets and local storage for credential recovery, which is especially risky in an AI-agent workflow because arbitrary tool invocation can operationalize those secrets without fresh consent. This creates a path from local desktop credentials to broad Slack data access.

Credential Access

High

Category: Privilege Escalation
Content: ### How it works 1. **Cookie decryption** — Reads the encrypted `d` cookie from Slack's SQLite cookie store (`Cookies` file). Decrypts it using the "Slack Safe Storage" key from the macOS Keychain via PBKDF2 + AES-128-CBC. Supports both direct-download and Mac App Store keychain account names. 2. **Token extraction** — Scans Slack's LevelDB storage (`Local Storage/leveldb/`) for `xoxc-` session tokens. Uses both direct regex scanning and a Python fallback for Snappy-compressed entries. The Slack data directory is auto-detected (direct download or App Store sandbox).
Confidence: 99% confidence
Finding: The same passage also indicates direct access to keychain-protected secrets and local storage for credential recovery, which is especially risky in an AI-agent workflow because arbitrary tool invocation can operationalize those secrets without fresh consent. This creates a path from local desktop credentials to broad Slack data access.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/auth.js:54