git-merge-report

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/merge-intel-report.sh, the workflow LLM ingests free text derived from local Git metadata (commit subjects/bodies from git log --reverse --oneline and paths from git diff --name-status/--stat/--numstat) in the specified --a-repo/--b-repo repositories, which are potentially outsider-authored via those repos’ history and filenames.