fleet-setup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill’s runtime path /agentloop:fleet-setup does interactive prompting (AskUserQuestion) but only uses first-party/template prompt files (<plugin>/fleet/prompts/<skill>.md) as content, while the only potentially outsider-authored text it ingests (cloud routine listing/job_config, crontab block, local repos.json) is not defined here as free text submitted by outsiders to a queue/feed that the workflow indiscriminately reads; the workflow does not show it reading arbitrary user-authored text streams for the LLM before item selection.