cass

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md’s required discovery workflow, the runtime calls cass search then cass view/cass expand on source_path entries, which are LLM-readable conversation text drawn from session JSONL logs that may contain outsider-authored free text (e.g., from user prompts/messages in those sessions) without additional filtering beyond line_number/title heuristics.