to-issues

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow explicitly says that if the user passes an issue reference (URL/number/path), it will “fetch it from the issue tracker and read its full body and comments,” which can include outsider-authored free-form text (issue comments/PR/issue bodies) that is then ingested into the agent’s LLM context.