trellis-session-insight

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). SKILL.md describes calling the local CLI trellis mem, which reads and “dump[s] cleaned dialogue” from the user’s past Claude/Codex/Pi/ZCode conversation logs at runtime; those logs are outsider-authored free text (other people’s prior assistant/user messages) that can be injected into the agent’s LLM context.