verify

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The verify skill’s required runtime workflow reads free text from the repository’s untrusted CONTEXT.md files (e.g., phase 1 runs context-discover.mjs and context-verify.mjs, which fs.readFileSync and parse CONTEXT.md contents for provenance, seam IDs, and enforced-by test citations), so an outsider who can submit/modify those files can inject prompt-like content into what the agent ingests.