workflow-test-fix

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's Phase 2 context-gather workflow (phases/02-test-context-gather.md, Mode B and the Multi-Source Context Discovery in Step B.3) requires the context-search/test-context-search agents to incorporate "Web examples (use Exa MCP for unfamiliar tech/APIs)" and other web-derived sources into the standardized context package, which the orchestrator and downstream agents (test-action-planning-agent, cli-planning-agent, @test-fix-agent) read and use to drive test/task generation and fix decisions—i.e., untrusted public web content is fetched and directly influences tool actions and strategies.