nano-banana-2

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow is belt app run ... --input ..., where the agent sends the user-provided prompt/images (including any outsider-supplied image URLs or text) into the model context via the inference.sh CLI/API; this is indirect prompt injection from outsider-authored free text.