Loading today’s stories
Build1 distinct publisher2 min readUpdated
An unofficial open-source CLI captures Slack session tokens through an ordinary browser login and writes them to disk. The approval step it removes was the one place anyone else got a look.
The Engineer · Build desk
Compiled by The EngineerSomething wrong?How this is made
File mode 0600 on `~/.config/slackcli/workspaces.json` [6] answers a question nobody was asking. It keeps other local accounts out. It has nothing to say about a process running as you, which is exactly what an agent handed shell access is [9][16].
The volume matters more than the permissions. One `auth login-auto` run opens a browser, takes an ordinary Slack sign-in, and captures session tokens for every workspace on that account [5]. Somebody in four workspaces produces four sets of live credentials from one login, in one file [15]. And because the whole point of the path is to skip building a Slack app and picking OAuth scopes [2], nothing on the way in narrows what those credentials can do: they carry whatever that person can read, including whatever the workspace search operators return across history [10][14].
The suggested integration is a prompt block that sorts commands into reads, which always take `--json`, and writes, which are labelled "ask me first" [9]. That is a request to a model, not a permission boundary; the binary is the same binary in both halves of the list [17]. Nearby, the same page notes that an empty search result still exits 0, so callers should check the data rather than the status code [12]. An agent that branches on exit status will read "found nothing" as "went fine".
The governable version of this ships in the same tool. There is a bot-token path for a server or a CI job [7], a `--workspace` flag to select an identity deliberately [8], and the author's own advice that Slack access is real access and automation should get its own bot-token profile [13]. That path is visible to an admin and revocable without touching a human's session. It also requires the conversation the headline promises you can skip [2]. Both roads are in the README; which one a team takes depends on who reads it first, the developer with an agent that stalled at the Slack boundary or the person who owns workspace access.
Worth being clear about the evidence. This is one post, published by the project's own side, with install instructions pointing at its own Homebrew tap [18]. The tool is unofficial and not supported by Slack Technologies [3]. The claim that nothing leaves your machine [6] is the author's, and it is the claim a security owner would most want verified independently, because it is unfalsifiable from the writeup alone. Read the token-capture code, not the bullet list about clean streams.
Follow any of these and your For You feed starts watching them — no settings page required.
Ranked by verification strength, evidence, and original report placement.
The post states that nothing leaves your machine and that credentials land in ~/.config/slackcli/workspaces.json with file mode 0600.
SlackCLI is described as a single open-source binary that talks to Slack from the terminal, with every read command supporting JSON output.
Per the post, getting an agent into Slack normally means building a Slack app, picking OAuth scopes, and waiting for an admin to approve it.
SlackCLI is an unofficial project and is not affiliated with or supported by Slack Technologies.
Installation is via a third-party Homebrew tap: brew tap shaharia-lab/tap, then brew install slackcli.
slackcli auth login-auto opens a browser, the user signs in to Slack as usual, and SlackCLI captures the session tokens for every workspace on that account.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Single self-published account, no independent verification
Every factual claim traces to one dev.to post written by the project's own author, who also controls the Homebrew tap it installs from. The mechanics described are specific and internally consistent (commands, flags, file path, mode, exit codes), which is worth something, but nothing in the cluster independently confirms what the binary transmits or stores, and the security-relevant assertion that 'nothing leaves your machine' rests entirely on the author's word. There is no audit, no second account, and no contradicting source either.
No usage evidence beyond the launch post
The only adoption-adjacent datapoint is the author's own release announcement. No download or install counts, GitHub stars, dependent projects, named deployments, or third-party usage reports are supplied, and the star request in the post implies uptake is being solicited rather than reported. Inferring an adoption level from a single self-published release would be a guess.
Convenience framing overstates safety of what is removed
The post's headline benefit is that no Slack app and no admin approval are needed, presented purely as saved work. Facts it states itself point the other way: an ordinary sign-in yields session tokens for every workspace on the account with no scope selection, they persist in one file that any same-user process can read, headless renewal keeps them alive unattended, and the read/write guard is prompt text rather than an enforced boundary. Reassurances like 'nothing leaves your machine' and mode 0600 are pitched as sufficient protection when the threat model actually created is an agent running as the same user. The gap is framing and omission rather than false statement, and the author does include a genuine rules section, which keeps this short of the extreme.
Author promoting his own unofficial project
The sole source is the maintainer's own launch content: installation runs through his shaharia-lab Homebrew tap, the piece closes with a request to star the GitHub repo and to file feature requests as issues, and the framing selects the comparison (Slack app plus admin approval) that makes his tool look maximally attractive. The project is also explicitly unaffiliated with Slack, so no platform party has an interest in correcting the account here.
Mechanics credible, consequences inferred, uptake unknown
Confidence is moderate-low. What the tool claims to do is documented at command level and is unlikely to be misstated in ways a reader could not check by installing it, and the security-relevant inferences follow directly from facts the post itself states. But there is one publisher, that publisher is the vendor, the central privacy assurance is unverified, and adoption is entirely unmeasured, so any conclusion about real-world impact is weakly held.
build
TrueFoundry open-sources an agent harness and calls managed agents a lock-in play2 distinct publishers
build
Config rot has a latency bill: a 70-line weekly audit for agent environments1 distinct publisher
build
A Notion agent that dies after each request, and the debugging error that broke version two1 distinct publisher
invest
Vercel's eve bets the agent plumbing layer consolidates the way Next.js did1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 23, 2026