forge-loop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow’s Step 5a spawns a sub-agent that reads PR content via gh pr diff and “read the full content of every changed file,” which ingests outsider-authored text from GitHub PRs/issues (i.e., contributions by other users) into the LLM context for review.