portolan-bootstrap

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required workflow, Phase 1/2/5 uses user-supplied remote service URLs (e.g., portolan extract <type> "<URL>" and then re-reads GetCapabilities/service metadata) so an outsider who can author/host that service content can supply arbitrary text that is ingested and shown for checkpointing (e.g., exact titles/descriptions/metadata fields).