review-proposals

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill loads and runs the playbook-monitor agent’s Step 5, which implies it reads a pending “proposals” file containing proposal text authored by the monitor agent/other system components (outsider-authored free text) and then presents that full proposal block to the LLM for review.