agent-observability-spec

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The skill requires logging “full input context (or content-addressed ref)” for every model call, which at runtime will include free-form text from the user’s request and any retrieved chunks/tool results; since the spec explicitly includes retrieval chunks “which chunks entered the context,” it can ingest outsider-authored web/wiki/issue text via RAG, creating indirect prompt-injection risk.