Slack will not patch this: one link opens a debugging port in the desktop app
trustsig.eu
A link containing devEnv=dev1 makes the Slack desktop client relaunch itself into developer mode with --remote-debugging-port=8315. Anything that reaches that port drives the app. Slack's security team calls it not a security risk.