cross-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads local agent session logs (.claude/projects and .codex/sessions) which store past user prompts, agent replies, and tool outputs from prior local sessions. Since user prompts and tool outputs in past agent sessions may contain untrusted external text (e.g., from pasted content, previous web scraping, or external inputs), this ingestion path carries indirect prompt injection risk.