to-tickets

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md:11 says that if the user passes a spec path, an issue number, or a URL, the skill will “fetch it and read its full body and comments,” which can pull in outsider-authored free text into the agent’s LLM context via runtime fetching of external/third-party pages or issue/comment bodies.