prd-to-todos

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and ingest PRDs from arbitrary URLs and GitHub issues (SKILL.md: "use webfetch for URLs" and "use bash ... gh issue view to fetch the PRD text") and then to read and act on that content to create todos, which exposes it to untrusted, user-generated third-party content that can influence actions.