Slk

• Analyzed: May 14, 2026, 3:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: e55bccfcc76bf90f6e42e8d31c4ec295d84472f4e79d433a8c1f1f3852e69ae1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to its core functionality involving the extraction of sensitive Slack session credentials (xoxc- token and xoxd- cookie) from the macOS Keychain, Slack's SQLite database, and LevelDB files. This is achieved by executing system commands like `security`, `sqlite3`, `openssl`, and `python3` via Node.js `child_process.execSync` and `spawnSync` (primarily in `src/auth.js`). While this capability is high-risk, it is transparently documented in `SKILL.md` and `README.md` as the tool's intended purpose, and there is no evidence of intentional malicious behavior such as unauthorized data exfiltration to external endpoints, persistence mechanisms beyond legitimate caching, or obfuscation. The `SKILL.md` instructions for the AI agent are benign and guide the agent to use the tool for its stated Slack interaction purposes.