kb-ingest

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md defines ingest as reading a user-provided “raw source … (argument, a path, or content the user dropped)” and then extracting text from that source in step 2/4, so an outsider can supply free text content that the runtime will ingest without needing the agent to select a specific pre-existing item.