afk-loop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md’s “Plan/Dispatch” flow, the loop reads user-authored issue text (issue title/body/comments) from the provided issue tracker (“Fetch issue {{ISSUE_ID}} from the tracker… It is your spec — title, body, and comments all count”), and also reads PR comments and check/log outputs at multiple stages (investigator/reviewer/qa/fixer prompts), so an outsider can inject poison by submitting text into issues/PRs that the workflow consumes.