to-plan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads outsider-authored GitHub issue text and comments at runtime in GitHub mode (“Fetch live GitHub state and read: the complete issue body and every comment”), so a user can supply poison via posting an issue/comment that the agent will ingest when invoked.