story-done

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md instructs the agent to read arbitrary story files and related referenced documents at runtime (e.g., the user-provided story path, plus production/session-state/active.md, production/sprints/, and the story’s referenced TR/ADR/GDD sections), and then “extract and hold in context” the story’s free-text acceptance criteria and other fields—so outsider-authored story content can be ingested into the LLM context.