summon

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context in summon recover/summon pick via the distillation call: the script reads the transcript JSONL from disk (extract_conversation()), which contains user/assistant messages authored by others, then concatenates that extracted text into the payload sent to claude -p (distill_brief()), so the LLM ingests outsider-authored conversation content.