replication-package

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The outsider-authored free text ingested at runtime is the user-provided project/package directory (via the required scan/copy/scrub/audit phases that read arbitrary files and scan their contents for AI traces and identities), so an outsider can include poison text inside those files for the agent to ingest.