harness-gepa

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/gepa.mjs, outsider-authored free text can be ingested at runtime via --path <genome.json>/--transcript <t.json> that are read and parsed into loadGenome(...)/validateGenome(...) or analyzeTranscript(entries) without any prior item selection gate.