legal-diagram

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In workflows/extract.md Step 3 (Pass 2) and workflows/direct.md, the agent ingests assistant-facing enriched evidence/snippets derived from user-provided file/pasted text/conversation context and then runs directive-driven LLM enrichment (manifest-driven), so attacker-authored text is directly read at runtime by the LLM.