work

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Given tickets, which the owner points to as URLs or paths on the issue tracker, are read and briefed to implementers at runtime, so outsider-authored issue text can reach the agent if the tracker accepts outside submissions (the rubric treats any GitHub issue reading as medium); the owner selects the ticket, but the tracker's contents are not verified as owner-authored.