dev-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md’s required runtime workflow reads the feature PRD/checkpoint markdown from $FEATURE_DIR/00-master-plan.md, $FEATURE_DIR/NN-sub-prd-*.md, and $FEATURE_DIR/checkpoint.md and passes them to the spawned feature-reporter agent as fenced <prd-content>/<checkpoint-content> text; if any of those files were authored by someone other than the operating user, this is outsider-authored free text entering the LLM context.