cali-windmill-orchestration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow is “Flow as Chat”/WAC tool-calling where the user’s chat message (flow_input.user_message) is injected into the LLM messages context as messages.push({ role: "user", content: text }), so it can include outsider-authored free text (the end-user) that the operating user did not author.