review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider-authored free text can enter the LLM context via Phase 1: audit_survey.py loads brief fields from .bon/items.jsonl (or bon list --jsonl for Dolt) across scan roots, and those briefs are then embedded into the Phase 2 subagent prompt as {json_items} for verification.