implement-plan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s runtime reads the plan artifact plan.md from docs/threads/<...>/plans/.../plan.md (outsider-authored free text risk) and then ingests its task text into the agent’s LLM context for execution/self-review; if that plan was authored by someone other than the operating user, it is outsider content.