changelog-audit

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via Phase 1.5/2/3/5 when the skill reads and then prompts over CHANGELOG.md sections from other git refs/tags (e.g., git show v<X.Y.Z>:CHANGELOG.md and git show <ref>:CHANGELOG.md), which are not authored by the operating user.