subagent-driven-development

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests user-provided plan/task text from docs/plans/... (Step 0 reads the full plan file once and Step 1/2 injects task full_text inline into the implementer and spec reviewer prompts), so outsider-authored free text can directly reach the LLM without selecting a specific trusted item.