cawplan-internal-qa-coding-session-test

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill reads data.messages[] from the cawplan session conversation --entry-id "<entry_id>" response in step 2, where the messages are the raw uploaded conversation text originating from the end user’s session (outsider-authored), and then uses that free text to generate the summary in step 3.