slack-token-extractor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited slack-token-extractor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Refresh expired Slack browser session tokens (xoxc/xoxd) used by Slack MCP server.
Need system Chrome/Chromium binary — CHROME_PATH must set in .env (e.g. CHROME_PATH=/usr/bin/google-chrome-stable). Playwright bundled Chromium never used — services fingerprint as bot traffic.
On headless servers, setup_slack_session also need VNC stack for interactive login:
apt install xvfb x11vnc novncPlugin check missing deps at startup, log warnings.
Use Playwright persistent browser contexts — after one manual login (human handle CAPTCHA/magic-link), later token extractions run headless using saved session.
Before tokens auto-refresh, human must log in once:
setup_slack_session(workspace_name="acme")Open visible Chromium window. Human complete Slack login flow (CAPTCHA, magic link, SSO — whatever Slack require). Session saved for future headless use.
On headless server (no X display), tool auto-start virtual display with noVNC web access on port 6080. Before calling setup_slack_session, tell human open http://<server>:6080/vnc.html?autoconnect=true in browser so can interact with login page.
Hardware security keys (YubiKey, FIDO2): noVNC cannot forward WebAuthn challenges — key must physically connect to machine running browser. If Slack login need hardware key, run setup_slack_session on local machine with key attached, then rsync profile to server:
rsync -az data/playwright-profiles/acme/ server:~/src/PERSONAL/pynchy/data/playwright-profiles/acme/Once session set up, tokens refresh headless:
refresh_slack_tokens(
workspace_name="acme",
xoxc_var="SLACK_XOXC_ACME",
xoxd_var="SLACK_XOXD_ACME",
)Tool navigate to Slack using saved session, extract fresh tokens, write to .env. pynchy service auto-restart on .env changes.
setup_slack_session again.timeout_seconds.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.