proof

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—during the HITL review loop, the agent reads Proof document state (including human-authored comment text) via GET /api/agent/{slug}/state?kinds=comment and then uses that retrieved free-form text to decide what to do, which is outsider-authored content entering the LLM context indirectly through the agent’s runtime state/mark ingestion.