I'm not sure I'd say it injects code in to 'their site', as slacks site never sees the code.

It injects code into the dom model of the users browser.