The Slack CLI that skips admin approval keeps live tokens in a file your agent can read

File mode 0600 on `~/.config/slackcli/workspaces.json` ^[1] answers a question nobody was asking. It keeps other local accounts out. It has nothing to say about a process running as you, which is exactly what an agent handed shell access is ^[9][17].

The volume matters more than the permissions. One `auth login-auto` run opens a browser, takes an ordinary Slack sign-in, and captures session tokens for every workspace on that account ^[6]. Somebody in four workspaces produces four sets of live credentials from one login, in one file ^[16]. And because the whole point of the path is to skip building a Slack app and picking OAuth scopes ^[3], nothing on the way in narrows what those credentials can do: they carry whatever that person can read, including whatever the workspace search operators return across history ^[10][15].

The suggested integration is a prompt block that sorts commands into reads, which always take `--json`, and writes, which are labelled "ask me first" ^[9]. That is a request to a model, not a permission boundary; the binary is the same binary in both halves of the list ^[18]. Nearby, the same page notes that an empty search result still exits 0, so callers should check the data rather than the status code ^[12]. An agent that branches on exit status will read "found nothing" as "went fine".

The governable version of this ships in the same tool. There is a bot-token path for a server or a CI job ^[7], a `--workspace` flag to select an identity deliberately ^[8], and the author's own advice that Slack access is real access and automation should get its own bot-token profile ^[13]. That path is visible to an admin and revocable without touching a human's session. It also requires the conversation the headline promises you can skip ^[3]. Both roads are in the README; which one a team takes depends on who reads it first, the developer with an agent that stalled at the Slack boundary or the person who owns workspace access.

Worth being clear about the evidence. This is one post, published by the project's own side, with install instructions pointing at its own Homebrew tap ^[14]. The tool is unofficial and not supported by Slack Technologies ^[4]. The claim that nothing leaves your machine ^[1] is the author's, and it is the claim a security owner would most want verified independently, because it is unfalsifiable from the writeup alone. Read the token-capture code, not the bullet list about clean streams.