agent-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow reads the host-selected review subject from stdin (which can include arbitrary repository/file text not authored by the operating user), then the helper feeds that free-form text into the reviewer LLM prompt via scripts/agent_review.py → build_prompt() → subprocess.run(..., input=prompt); the “outsider” free text is the review input portion passed by the user/host context.