single-user-inspector

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, the runtime flow ingests the outsider’s free-form “User Input” (intent recognition + parameter extraction) and uses extracted identifiers/time ranges directly to run ae-cli queries against ae-analysis, so attacker-authored text can influence which user/event/property data is read.