write-outreach

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via the reply route: the prospect’s inbound reply (authored by a non-operating-user outsider) is passed verbatim into agents/reply-classifier.md → agents/reply-composer.md as inbound_reply, which the agent uses to draft the response.