kelly-legal-precedent-desk

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, the deployed AirApp reads complete Busabase “items/entities/checks/settings” text records (including agent-generated fields like summary, body, draft, recommendation, court_pattern, and decision_note) via busabaseProvider.getState() → readAllRecords() and then renders/uses them, so an outsider who can submit records into that workspace/feeds the app’s Busabase bases could inject free text.