markdown-a11y-assistant

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow feeds the contents of markdown files from the repository into the markdown-scanner sub-agent via the Task tool (“Pass full Phase 0 context to each sub-agent” and “Dispatch markdown-scanner … for all discovered files”), and those files are outsider-authored unless the operating user authored them; thus there is a runtime path where arbitrary file text becomes LLM-readable context.