repo-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Stage 1 explicitly “Pull every open GitHub issue and epic into context” and Stage 2 personas run on that Stage-1 context; GitHub issue/epic bodies are outsider-authored free text when not written by the operating user, so it can be ingested into the LLM context via the backlog-loading path.