knowledge-ops

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime ingestion/sync workflow explicitly pulls from outsider-authored sources like “GitHub issues, PRs, discussions, release notes, Linear issues/projects/docs” (Layer 1) and “Conversation Sync” from “other agent sessions,” which can include free-form text authored by non-operating users that the agent then reads and places into its LLM context.