worktree-fleet

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's worker spawn logic (lib/worker-spawn.sh + lib/tools.sh) and launch.sh worker-type mapping explicitly enable provider web tools (e.g., pi --tools includes web_search,fetch_content and codex can be given web_search via extra flags), so spawned workers can fetch arbitrary public/web content which the agents will read and act on (in their worker prompts and commits), exposing the agent to untrusted third‑party content.