safehouse-worktrees

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's "Creation Steps" → "Run Project Setup" explicitly runs package managers (npm install, pip install -r requirements.txt, poetry install, cargo build, go mod download, etc.), which fetch and may execute code from public package registries (untrusted third‑party sources) as part of the required workflow and can materially influence subsequent actions.