agent-return-setup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow that reads outsider-authored text is the agent-return-guard.mjs hook, which ingests stdin JSON fields last_assistant_message coming from the subagent’s prior free-text return (“SubagentStop” → readStdinSync → decide → estimateTokens), so a user can influence it by submitting a long natural-language return.