review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 3, the runtime review step uses Baz cross-repo tools (repo_search, remote_grep, remote_file_search) to read code in other repos as part of the checks, and those sources can include outsider-authored free text (e.g., untrusted repository contents or issue/PR-linked text if Baz surfaces it) without selecting a specific item first.