Slack — agentic threat model

Not certain from the listing — The underlying LLM is not specified, but it is vulnerable to prompt injection attacks that could trick the model into executing unauthorized Slack searches or leaking retrieved message contents.

The agent accesses Slack channels, threads, and messages. The primary threat is data exfiltration of sensitive, proprietary team discussions and intellectual property pulled from Slack history into the agent's context window.

The agent utilizes a Slack MCP (Model Context Protocol) server. Vulnerabilities include insecure tool integration where the agent might be manipulated into calling search or read tools with malicious parameters to bypass intended scope.

Not certain from the listing — The hosting environment of the MCP server and how Slack API tokens are securely stored, isolated, and rotated are not detailed in the public directory listing.

Not certain from the listing — There is no mention of logging, audit trails for MCP tool execution, or guardrails to prevent the retrieval of highly sensitive channels (e.g., HR or executive channels).

The agent relies on Slack OAuth/API permissions. A key threat is privilege escalation or unauthorized access if the agent's token has broader channel access than the user interacting with the agent.

The agent connects team communication to the development loop. If chained with code-generation or execution agents, a compromised Slack agent could feed malicious context or instructions into downstream development tools.