session-scan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly instructs agents to fetch and parse session transcripts from the ccrider service (SKILL.md step 5: "fetch one session transcript from ccrider") and compute-metrics.py processes those ccrider message JSON files (parse_messages / extract_user_messages), meaning untrusted user-generated transcript content is read and used to compute scores that drive triage and follow-up actions, creating a clear avenue for indirect prompt injection.