knowledge-ingest

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). Outsider-authored free text is ingested at runtime via the dispatched source-ingester tool flow: Task(source-ingester, URL=<url>, ...) where URL originates from runtime fetched candidate/source data in candidates.json/fetch-manifest.json, and the ingester writes a wiki/sources/<slug>.md page that Step 4 then audits/backlinks; since the LLM context can include the fetched page/body text from those URLs, this is an indirect prompt-injection surface.