fan-out

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the planner delegates to bounded subagents via Task/Workflow that “read every result,” and these subagents are explicitly scoped for “read-only | edit ONLY ” but the required workflow provides no guarantee that the subagents’ read inputs exclude outsider-authored free text (so an attacker-provided string could be ingested if it lands in the repository/monitored read surface the workflow examines).