om-gap-analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Phase 2 runtime context can include outsider-authored free text from the tracker snapshot: it fetches open PR titles (and review decision/depth fields) via the tracker’s list-prs operation into .ai/tmp/om-gap-analysis/pipeline-snapshot-<project>.md, which is then provided to subagents as <PIPELINE_SNAPSHOT> (prompt context).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The orchestrator preflight (bin/gap-orientation-preflight) can git-clone the platform repo at runtime (defaulting to https://github.com/$repo.git / the https://github.com/.git shape), and the checked-out repo may contain a repo-local .ai/skills/om-gap-analysis/SKILL.md that the agent will apply as a runtime extension to its instructions, so remote content fetched from that URL can directly control agent prompts.