memory-gardener

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider-authored free text can enter the LLM context via the memory records being processed (e.g., “new record … created from a real conversation” in prompts/dedup-validate.md and the “record … description” inputs used by bloat-scan.md/bloat-split.md), which are not authored by the operating user and are then embedded into the prompt’s User message JSON.