orchestrate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/cli.ts orchestration loop, the root/subplanners ingest the free-form contents of handoffs/<task>.md (worker/verifier Markdown handoff bodies) as the sole information source for deciding what comes next, so an outsider can author poison by producing those handoffs via cloud agents (including content mirrored from Slack thread replies/Andon reason).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The orchestrator requires a repoUrl (e.g. https://github.com/example-org/example-repo) in plan.json and spawns cloud agents that clone and run that repository at runtime, so the external GitHub repo is a runtime dependency whose fetched code is executed by agents.