Markdown support for links from users is a bad idea and just makes phishing attack easier as many organizations have public channels.
however, anybody with a bit of javascript knowledge can do it. I guess we need to keep educating people about the importance of checking urls?