to-tickets

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow explicitly says to “fetch it and read its full body and comments” when the user passes a spec path/issue number/URL, which can pull outsider-authored free text (e.g., public web pages or issue/PR/wiki comments) into the agent’s LLM context.