autoimplement

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). Outsider text can only enter the workflow via a plan file path provided by the invoking user, and the required runtime reads that resolved local file only (then passes its contents as <PHASE_CONTENT> to the subagent); there is no queue/feed/email/social/chat/comment/ticket ingestion path in the required workflow.