The README looked harmless. The model saw a hidden instruction.

How indirect prompt injection reaches an agent through a tool result, and how an open source proxy stops it before the model reads it.