role-x

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). Yes: the required scripts/role-x-intake-hook.sh runs role-x.py intake, which reads the current user prompt (stdin/JSON hook payload) and also loads Markdown from the workspace roles/*.md (including YAML frontmatter and prose) into the printed intake context; while those roles/ files are in the operator’s workspace (not an explicit “outsider”), the hook’s runtime prompt string is an unchosen external party’s contribution (the user/operator’s end-user prompt) and becomes LLM-readable context.