summon

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Source: the “in-chat card picker” runtime path summon widget reads existing transcript JSONL user/assistant text from the local Claude projects store and inlines it into assets/picker-widget.html’s <script id="D"> payload (via session_rows(..., rich=True) → analyze_transcript()/firstAsk, and mode_widget() assembling/injecting widget_code), so outsider-authored free text contained in those transcripts can be fed to the in-chat widget/agent context.