start

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). In SKILL.md step 0, the workflow reads the local repository state (e.g., masterplan.md/CHANGELOG.md and existing issues/plan records), but it does not ingest outsider-authored free text via a monitored external queue/feed; GitHub issues/PR bodies are treated as existing project records only when the project itself is the source (the attacker can’t force arbitrary submission into what the agent reads without being able to create those items in the project).