scope-creep-detector

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow ingests the target repository’s unified diff at runtime via read_diff()—either from --diff file, --diff - stdin, or by running diff/git through run_git()—and then processes the diff text (parse_diff(diff_text)) into LLM-visible JSON/text fields, so outsider-authored free text from the repo (diff hunks and headers) flows into the agent’s context.