clinical-note-extract-skill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider free text is the clinical note content itself: workflows/extract-batch.js passes each note’s n.text (untrusted user-supplied text/file-derived prose) inline into the note-extract-worker prompt as <NOTE>...</NOTE>, which the worker then reads into the LLM context.