codex-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly states in SKILL.md (Cross-Project Usage) that "Codex reads AGENTS.md files from the project root ... If the target project has an AGENTS.md, Codex will follow it automatically" — meaning it will ingest and act on arbitrary, project-supplied (potentially public/untrusted) instructions that can change its behavior.