pgflow

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow for /pgflow debug reads run and step state records (including r.input, r.output, ss.error_message, and ss.skip_reason) from the tenant’s PgFlow/Postgres tables based on an outsider-supplied run_id/flow slug/failed selector, so attacker-authored queued run content is ingested into the agent’s context for reporting.