The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The slack-token-refresh.sh script extracts authentication cookies (d cookie) and session tokens (xoxc) from the local Google Chrome installation on macOS.
It locates and copies the Chrome Cookies database to a temporary directory.
It uses AppleScript to extract Slack's localStorage tokens from active browser tabs.
[COMMAND_EXECUTION]: The skill uses high-privilege system commands and scripting interfaces to harvest credentials.
Uses security find-generic-password -s 'Chrome Safe Storage' -w to programmatically access the macOS Keychain and retrieve the decryption key for the browser's cookie database.
Uses osascript (AppleScript) to execute JavaScript inside running Google Chrome tabs, which can bypass some browser security boundaries.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes code from remote repositories at runtime.
The slack-token-refresh.sh script uses uvx --from pycookiecheat to download and run the pycookiecheat package from PyPI.
The slack-browser-session.sh script performs an unversioned npm install and npx playwright install chromium to download the Playwright framework and the Chromium browser engine.
[REMOTE_CODE_EXECUTION]: The playwright-bridge.js script contains an execute function that allows the execution of arbitrary JavaScript code within the browser context using page.evaluate(input.code). This provides a direct path for dynamic code execution of instructions supplied at runtime.
[DATA_EXFILTRATION]: Extracted authentication secrets (SLACK_XOXC and SLACK_XOXD) are stored in a local environment file at ~/.agents/config/slack/tokens.env. While local, this makes these sensitive credentials accessible to any process with read access to the user's home directory.

slack