Slack (Zencoder) — agentic threat model

Not certain from the listing — the underlying LLM is not specified as this is an MCP server, but any connected model is highly vulnerable to indirect prompt injection via untrusted Slack message history read by the tool.

The agent reads Slack channel history, which acts as an untrusted, dynamic external data source. There are no built-in sanitization or provenance checks mentioned for this ingested message data.

Exposes powerful tools for reading/posting messages and managing channels. Insecure tool integration or lack of strict input validation allows an LLM to be manipulated into executing unauthorized Slack actions.

Supports stdio and HTTP transports. Security relies entirely on the host environment's isolation and how securely the Slack bot/user token is stored and accessed at runtime.

Not certain from the listing — there is no mention of built-in logging, guardrails, or anomaly detection to monitor for malicious tool calls or suspicious message-posting patterns.

Authentication relies on a Slack bot/user token. Authorization is binary (determined by the token's scopes) with no granular, user-level access controls or human-in-the-loop confirmation mechanisms described.

As an MCP server, it is designed to be integrated into broader agent ecosystems, creating a high risk of cascading failures if another compromised agent invokes these Slack tools to exfiltrate data or spam channels.