inbox

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow reads inbox item .md files from ψ/inbox/ (via ls and then “Read and display full content”), and those files can be authored by outsiders (e.g., other Oracles/agents via /forward or oracle_handoff()), so their free-form markdown body becomes LLM-readable context.