java-21-to-25-migration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's instructions (Rule 13 in SKILL.md and the verification steps in references/phase-1-build.md and Phase 1/1.3) explicitly require the agent to fetch and read GitHub releases pages, query Maven Central (curl to repo1.maven.org), and check public Docker image tags — forcing it to ingest and act on untrusted, third‑party web content that can materially change dependency/version decisions and tool use.