hands-free

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text enters at runtime via scripts/call_user.py extracting the phone caller’s speech/transcript (extract_user_answer from the Vapi call artifact/transcript) and then printing it; the surrounding playbook explicitly says stdout is treated as the user’s reply verbatim, which will be fed back into the agent’s LLM context.