slack

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Slack Actions can use the readMessages action to fetch recent Slack message body text from a channel at runtime, which is outsider-authored free text from other users (not chosen by the operating user) and would be ingested into the agent’s LLM context.