mailbox

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can be ingested from the filesystem inbox: mb_list/check/wait drain unread *.md files from /tmp/agent-mailbox/<id>/inbox/, and those files’ YAML frontmatter/body are authored by other agents (outsiders) and become LLM-readable when the flow opens them (e.g., head in check).