ISA

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Workflows like Workflows/Append.md accept and validate caller-supplied free-text fields (e.g., append decision ...: <text> / append learning ...) and then write them into the ISA, so outsider-authored text can be ingested at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.40). This skill mandates executing a local curl POST immediately (lines 1–11,18) and describes generating/writing and reconciling files into local paths (MEMORY/WORK and ~/.claude, lines 204–211,220–231), which causes non-trivial state changes on the host even though it does not request sudo or create users.