dag-fleet

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly enables workers of type "research" to use WebFetch/WebSearch (see references/worker-types.md and lib/tools.sh get_pi_tools / get_disallowed_tools) and the DAG workflow (fleet.json depends_on + examples) requires downstream workers (e.g., a synthesizer) to read researcher outputs, so untrusted web content fetched by researcher workers can be ingested and materially influence later tool use and actions (also reinforced by the relaunch-worker addendum which tells the operator to "edit prompt.md (add the new sources / instructions)").