machines

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill reads outsider-authored free text from ψ/contacts.json (e.g., each contact’s notes field) and injects it into the LLM context when generating the local .claude/skills/<node>/SKILL.md content (Step 3), since those notes are not authored by the operating user.