malloy-discover

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the discovery workflow ingests model-derived/metadata-derived content by calling get_context to read the package’s sources/views/fields and then uses execute_query to preview queried data (and also reads prior-art files like metadata.json and metrics/KPI docs from the project), which can be influenced by outsiders if they can author those files/records.