pre-session-end

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s Step 1 (“Review the chat history”) and Step 2 (“Present Extracted Learnings”) can ingest outsider-authored free text from prior messages (e.g., other users’ chat messages, issue/PR/discussion content) into the LLM context via the runtime chat history, creating an indirect prompt-injection risk.