tres-rollup-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md’s runtime workflow reads outsider-authored rollup candidate/submitted rule objects (already present in the conversation context) and then passes them verbatim as the $rule input to the subTransactionRollupRulePreview GraphQL query via the TRES Finance MCP connector execute tool, which causes ingestion of that free-text-derived rule configuration for server-side matching.