rails-activity-timeline

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's AI summaries flow (references/ai-summaries.md and app/services/activity_summary_generator.rb) explicitly sends user-provided field values (event.from_field_value / to_field_value from ActivityEvent.details) to an external LLM via Raix/OpenRouter, so untrusted user-generated content is ingested and can influence model behavior and downstream timeline updates.