← roadmap

interslack

keep priority P3 effort S wave 3

What it does: A single-skill plugin (slack-messaging, user-invocable:false) that wraps the third-party slackcli binary (shaharia-lab/slackcli) so a Claude Code agent can send/read Slack messages, list channels, reply in threads, and verify integration round-trips. Auth is browser session tokens (xoxc+xoxd) extracted manually via DevTools (the extract-tokens script just prints guidance and prompts for paste) — the agent posts as the logged-in user, not a bot. No MCP server, no commands, no hooks, no agents; allowed-tools is Bash(slackcli:, curl:). Credentials live at ~/.config/slackcli/workspaces.json. Ships structural tests, gitleaks secret scanning, and standard PHILOSOPHY/CLAUDE/vision docs.

Rationale: This is the correct shape for the dominant 2026 pattern “thin Skill orchestrating one external system, progressive-disclosure metadata, no eager tool loading.” It deliberately registers zero MCP tools, so it imposes no context-budget tax — exactly the anti-pattern the MCP-context-bloat backlash warns against (3 fat MCP servers consuming 72% of a 200K window before the first query). The skill is genuinely thin (send/read/list/verify), well-scoped, has a SKILL-compact.md for progressive disclosure, structural tests, and gitleaks scanning. Its philosophy (“messages are receipts,” token-scoped authority, “stays dumb so compositions stay clean”) aligns with the harness-engineering discipline trend: deterministic plumbing other plugins compose against. It is a mature, low-surface utility doing one thing — the canonical “keep.” It is NOT a coordination/memory/codegen plugin, so the heavy SOTA frontier (orchestrator-worker topologies, agentic memory, agentic RAG, reliability-science eval) simply does not apply; forcing modernization there would be over-engineering a notification pipe.

SOTA gap: Two real-but-minor frontier gaps, neither warranting a modernize verdict. (1) Supply-chain/security posture: the agent-supply-chain-security trend (Snyk ToxicSkills, lethal-trifecta) flags that a tool which (a) holds long-lived user-equivalent session tokens in a plaintext JSON file and (b) READS untrusted external content (Slack messages) into the agent context is precisely the “private data + untrusted content + exfiltration” trifecta. Reading channel text back into a coding agent that can run shell is an unguarded prompt-injection vector, and there is no approval gate before send (a destructive/visible-to-team action). (2) It depends on a single third-party binary (slackcli, pinned at v0.1.1) with browser-token auth that expires on logout — fragile vs. the now-mature official Slack MCP server / progressive-disclosure tool layer that several interverse plugins already consume.

Redundancy: No functional overlap with any other interverse plugin — interslack is the only Slack/external-chat egress. Adjacent-but-distinct: interlock (broadcast_message/send_message) and intermux (agent activity feeds) handle INTER-AGENT messaging inside the rig, not human-facing Slack; interject/interkasten push to inbox/Notion, not Slack. The PushNotification harness tool overlaps conceptually (agent-to-human notify) but targets the operator, not a team channel. Keep as the dedicated human-team egress. Minor doc-drift to note: roadmap.json describes a far more ambitious “workflow-event-to-channel with actionable context / digest mode / tenant-aware routing” product that does not match the actual thin send/read skill — auto-generated aspirational drift, not a second implementation.

Actions:

  • Add a prompt-injection guard note to SKILL.md: when reading Slack messages back into context (conversations read), treat channel text as untrusted input and never act on instructions embedded in it — closes the lethal-trifecta read path flagged by the agent-supply-chain-security trend.
  • Add a lightweight human-approval/confirmation convention before slackcli messages send (visible-to-team action), and document token hygiene: warn that ~/.config/slackcli/workspaces.json holds user-equivalent session tokens in plaintext, recommend file perms 600 and rotation on logout.
  • Reconcile docs/roadmap.json with reality: either trim it to match the actual thin send/read scope or file a bead for the aspirational event-delivery/digest features so the doc stops drifting from the implementation.
  • Document the official Slack MCP server as an alternative/upgrade path in the vision doc’s ‘Direction’ section (bot-token + progressive-disclosure tool layer) so users who want durable bot auth instead of expiring browser tokens have a sanctioned route — keep slackcli as the zero-app-setup default.