opencode-delegate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/relay.mjs, the relay reads an outsider-authored --brief (file or stdin) and pipes it to the opencode run process on child.stdin.write(brief), meaning free text authored by the workflow invoker is ingested at runtime.