gds-test-framework

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). SKILL.md Step 3 (“Load Persistent Facts”) loads workflow.persistent_facts entries prefixed with file: (e.g., file:{project-root}/**/project-context.md) into the agent’s LLM context as readable file contents at activation time, and those files are not guaranteed to be authored by the operating user.