spiral

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's required Dependency Upgrade Gate and DEPENDENCY_LEDGER.md explicitly instruct the agent to run Detect-new commands and read upstream CHANGELOGs / GitHub releases (public third-party URLs) as part of its loop (see docs/DEPENDENCY_LEDGER.md and docs/IMPLEMENTATION_PLAN.md), meaning the agent must fetch and interpret untrusted user-published release notes that can influence upgrade/PR decisions.