consensus-plan-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In references/command.md, the workflow takes $ARGUMENTS/user task verbatim into prompt.md and then feeds that free text into external model CLIs via pi/OpenRouter, agy, and qwen commands (e.g., $(cat "$SESSION_DIR/prompt.md")), so an outsider can submit poison free text through the invocation input that is ingested by the models.