watch-and-act

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path shown in SKILL.md/scripts polls an external signal by executing real state-check commands (e.g., gh run list / gh pr checks or curl health check / queue depth query) and then records observed evidence, meaning any outsider-authored text returned by those external APIs (such as GitHub PR/issue/check text) can be ingested without prior selection of a specific trusted item.