speckit-runner

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The operator workflow polls remote worker state via poll-worker.sh/poll-reviewer.sh (curl to ${PYLOT_API}/missions/${PYLOT_JOB_ID}/workers/...) and ingests worker last_output which is itself influenced by outsider-authored GitHub issue/PR content, but the required runtime does not directly ingest arbitrary outsider free text without the worker selecting it.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime calls to the dispatcher API (e.g. "${PYLOT_API}/missions/${PYLOT_JOB_ID}/workers" and related endpoints) to spawn LLM workers and fetch their generated outputs which are then injected into prompts sent to other workers, so remote content from these URLs directly controls agent instructions.