project-related-context

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow ingests outsider-authored free text when it “shallow-cloned to scratch” and then reads sibling content from user-supplied git URLs (public web/git content) to produce evidence/first_read, which is then merged into the LLM context and written into docs/rules.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly accepts git URLs (e.g., git@github.com:org/shared-contracts.git) and shallow-clones sibling repositories at runtime to read their contents as "evidence" and "first_read", which means fetched remote content is injected into the agent context and can directly influence prompts/outputs.