pp-prediction-goat

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Exposes outsider-authored free text because the CLI’s “Agent Mode” explicitly instructs the decision tree to read Playbook.notes and Notes verbatim (and those notes can originate from prior teaches/learning generated from user-supplied recall queries and stored learning), so untrusted user text can indirectly become stored instructions consumed later at runtime.