trace

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The runtime workflow runs grep over repository text files under docs/specs/, docs/architecture/, and test directories, so any outsider-authored free text already present in those files (e.g., contributed by other users via PRs/issues) is ingested as readable text via shell command output into the agent’s context; the skill does not restrict inputs to user-authored content.