design-codebase

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In skill-protocol.json the stateless run command reads only the caller-supplied draft path ({input.draft}) and seals/validates its Markdown via scripts/seal_assessment.py→handoff_contract.seal_handoff, so outsider-authored free text can be ingested by posting a crafted draft file.