github-copilot-sessions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill’s runtime workflow reads outsider-authored free text from ~/.copilot/session-state/<UUID>/events.jsonl (via the --no-db pure-Python BM25 path, which streams and indexes user.message, assistant.message, tool.execution_complete.result.content, and session.task_complete.data.summary), and those messages can include content contributed by parties other than the operating user.