routing-brains

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s runtime workflow ingests “meeting items” (free-form text) provided by the operating user’s meeting source; if those items include outsider-authored content (e.g., comments/messages from other participants), that free text is then processed and inserted into the agent’s LLM context during item segmentation/routing and the “Unmatched Content Handling” prompt.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The prompt instructs the agent to scan and modify the host filesystem (list /Brains/, create folders and generate CLAUDE.md files), which changes machine state, though it does not request sudo privileges or edits to system config or user accounts.