security-and-hardening

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow runs the native package-manager audit and inspects dependency install-script source and new packages, which are community-authored public registry content the agent must actively fetch by selecting specific packages, so it is low risk rather than medium.