sweep

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). Yes—outsider-authored free text from fetched feedback sources (e.g., Slack/GitHub/email message bodies and issue/comment text) is ingested into the orchestrator via the extraction-tier subagent outputs and then folded into the LLM-visible plan/summary context (e.g., body/quote/evidence fields and “Untrusted customer content” blocks), creating an indirect prompt-injection path.