qwen-delegate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The workflow reads local user/workspace files via file tools (read_file, search_files, list_dir) and processes stdin/prompts; although files inside the working directory may contain untrusted text written by third parties, the agent operates as a local utility without an automatic external publishing or message-monitoring vector (such as an email inbox, pull request monitor, or chat feed) that would classify it as medium indirect prompt injection risk.