recipe-code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md Step 3 explicitly says the LLM “reads each in-footprint file” across the computed diff/footprint, so the agent’s LLM context will include free text from repository files that were not authored by the operating user (outsider-authored code/content), creating an indirect prompt-injection path via file contents.