qa-executor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Plane context ingestion treats Plane work item descriptions/comments/attachments as source context; those are outsider-authored free text from non-operating users and can be read into the agent’s LLM context via the Plane read/resolve workflow.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly reads external Plane and Notion URLs at runtime to load work-item and test-case content that directly controls execution instructions and state transitions (for example: https://notion.so/workspace/Auth-Test-Cases-db123 and https://app.plane.so/acme/projects/eng/issues/42), so these external resources can directly control the agent's prompts/workflow.