rules-distill

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider free text can enter the LLM context via Phase 1 inventory: scripts/scan-skills.sh reads description from each installed skill’s SKILL.md (which may be authored by third parties) and Phase 2 passes “full text of skills in this batch” to the subagent for LLM judgment.