spec-kitty-sync-plugin

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill explicitly runs spec-kitty init to pull upstream command templates/mission configs into .kittify (Step 2) and then requires the agent in Step 3b to read and reconcile those auto-synced .kittify files, meaning the agent ingests upstream third-party content that can materially influence subsequent actions.