semantic-compressor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In “Compress or apply workflow” the agent reads entire outsider-authored source files selected from user-project paths (including .claude/skills/**/*.md entrypoints) and also delegates their full contents to a “fresh subagent” via `source path, candidate path, and inventory path” for semantic review, so attacker-provided text in those Markdown files is ingested at runtime.