autoresearch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md (“step 4: establish baseline” and “step 5: run the experiment loop”), the workflow ingests user-provided “test inputs” and reads the resulting “actual outputs that failed” to analyze failures and mutate SKILL.md, so outsider-authored free text can flow into the runtime via the user’s prompts (and then into the LLM for scoring/failure analysis).