code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The workflow reads outsider-authored free text from the repo itself at runtime—e.g., commit messages (git log <fixed-point>..HEAD) and PR description/implementation log (gh pr view / .implementation-log.md)—and then injects that text into the sub-agents’ prompts via the “Intent sub-agent prompt” tool call.