context-firewall

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via the runtime “work item inputs” that the sub-agent reads (e.g., public web pages, issue/PR/wiki/discussion text, or other third-party messages) before returning a distilled result; the skill’s firewall doesn’t prevent that initial ingestion inside the sub-agent context.