reflect

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s runtime workflow only reads user-supplied local JSON prediction/commitment logs via --input paths (e.g., scripts/calibration_scorer.py → load_predictions(path) and scripts/reflection_prompt_generator.py → load_commitments(path)), which is free text originating from the user and can include arbitrary strings, so an outsider can submit poison if they can place those files/entries into the workflow’s inputs.