review-implementation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow reads thread-root files like spec.md/plan.md/seed.md/decisions.md and implementation-report.md from docs/threads/<...>/, which are outsider-authored free text in the general case (e.g., implementer/other participants), and that text is ingested into the agent’s LLM context during “Resolve the anchor and read the report.”