multi-model-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the Root/Codex lane executes codex exec with --cd <repo> and explicitly instructs the model to “read changed files fully” from the provided repository diff/context (i.e., outsider-authored code/text submitted via the PR/workspace).