pk-track

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md describes a local-file “inbox execution” step that reads inbox/*.md items with domain=execution and status=pending, so outsider-authored free text can enter those inbox files before the workflow processes them (e.g., items of type thought/resource are read and used to drive user prompts and status transitions).