skill-comply

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text is ingested into the classifier LLM context via scripts/classifier.py: it builds tool_calls from ObservationEvent.input/output parsed from claude -p --output-format stream-json, where the tool call inputs/outputs can include arbitrary text produced by the agent and tool results (not authored by the operating user).