best-practices-prompt

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the run.sh->template.html “Optimize (fix violations via LLM)” flow, the browser constructs a userMessage from PROMPT_TEXT (the uploaded prompt file contents) and optional HUMAN NOTES and then POSTs them to the local /v1/chat/completions endpoint, so outsider-authored prompt text is ingested without selecting a specific item from a trusted list.