trade-off-analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's bundled technical-research workflow (e.g., references/bmad-technical-research/workflow.md and technical-steps/step-02-technical-overview.md, step-03, etc.) explicitly requires "Search the web" and to ingest and cite public URLs and uses those findings to generate scores, recommendations, and next actions, so it clearly reads and acts on untrusted third-party web content.