worklog

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Required workflow step 3→4 reads a session transcript from disk (scripts/get-session-transcript.ts) and then a sub-agent ingests that transcript content into the LLM context; for OpenCode/Pi those transcripts can include messages authored by others, so it’s an outsider free-text injection surface via the session transcript.