codex-plan-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At Step 2, the skill feeds Codex a runtime prompt that explicitly instructs it to “Read the plan at <PLAN_FILE> (and any repo files you need)” and to produce verdicts, so if an outsider can cause PLAN_FILE/repo files to contain attacker-authored free text, that text is ingested without selecting a specific item.