run-delivery-chain

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Runtime path: driver.sh creates a temp host repo and writes a JSONL transcript containing a fenced status block, then passes {"agent_type":..., "transcript_path":...} to python3 scripts/agent_memory_hook.py subagent-stop via stdin; the hook reads that outsider-authored transcript text from the filesystem and injects it into the LLM context during subagent-start (via additionalContext).