knowledge-finalize

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). Outsider free text can enter the LLM context via the portal-narrator agent (Step 10.5 sub-step 3.5): it builds a portal-bundle.txt by reading wiki/index.md (which may include human-authored lead-ins/bullets) and then dispatches Task(portal-narrator, BUNDLE_PATH=...), so the agent receives that page text as prompt/context at runtime.