implement-plan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). Yes—this workflow reads the plan artifact’s index (plan.md) and task files (tasks/NN-*.md) from docs/threads/<...>/plans/... at runtime, and those files are outsider-authored free text if the operating user did not author the plan (e.g., plans compiled from an external source via the Source: line), which then becomes LLM context during “read the index” and “read the task file and implement”.