tribunal

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow, bin/detect-runners --json executes installed third-party model-discovery CLIs (e.g., codex debug models, agy models, cursor-agent models, etc.) and ingests their stdout text to build a model roster, so an outsider who can control that CLI’s output path could inject free text without selecting a specific item first.