sitrep

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 2/3/4, the required runtime reads lane outputs produced from gatherer-protocol.md, which in its BACKBONE lane explicitly reads in-repo handoff/pause markdown and scans them for markers, and that file text is outsider-authored if an outsider can write those files (e.g., via monitored queue/feed/file submission), making it an indirect prompt-injection surface.