agent-slack

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text from Slack (e.g., message get/list content and attachment unfurls) is fetched at runtime and then ingested into the agent’s LLM context via the command’s readable output fields like content (and possibly canvas get Markdown), which can contain attacker-controlled text.