recipe-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md’s required runtime flow spawns sub-agents (code-reviewer/security-reviewer/task-executor) with “Design Doc path” and “Implementation files: [git diff file list]”, which implies the orchestrator will read outsider-authored text from files on disk (Design Docs and code reviews) and include their contents in LLM prompts, enabling indirect prompt injection via those repository texts.