ralph-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The runtime path “Read <PROJECT_ROOT>/.llmtmp/ralph-plan.md then parse ## Inputs and plan documents: and read each referenced path” ingests free-form markdown authored by someone other than the operating user (outsider-authored plan documents / forwarded files) into the subagent’s LLM context.