recap-ask

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). /recap-ask loads an entire first-party-selected recap document from a user-supplied --context path, and the recap’s embedded §7 Evidence file-index can cause further runtime reads; additionally the user’s free-text question is ingested for intent classification and may drive Codex synthesis, making indirect prompt injection feasible via the recap content (outsider-authored if the user provides a poisoned recap/doc path).