migrate-workflow

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow reads outsider-authored free text from the current repository’s legacy Markdown sources during the scan/build_manifest phase (e.g., task bodies and roadmap content under docs/src/features/**, tasks.md), and that text is then processed into the migration manifest and further into Beads.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The adopt-template.py script defaults to and at runtime may fetch the remote Copier template "gh:RobertDeRose/dstack" (via git ls-remote and copier.run_copy) and then renders and merges template files such as AGENTS.md into the repository, meaning remote content can directly control agent-facing instructions and the adoption behavior.