Design a tool-result / RAG-poisoning attack family

[bamdadd]

Context: leakgauge ships three published attack families — delayed, assembly, encoded (built via _build in src/leakgauge/cases.py:232; see How it works). A fourth published pattern is not yet modeled: injection delivered through a tool result / retrieved document (RAG or tool-output poisoning) rather than an inbox email — the payload rides in what a tool returns mid-task, which is a distinct and well-documented indirect-injection channel.

What to do (design first, then implement):

• Propose a new family that fits the frozen contract in docs/CONTRACTS.md: the benign task must actually consume the poisoned tool result (on-path), canary / exfil_spec and the scorer stay unchanged, with a programmatic utility check. Published patterns only — no novel jailbreaks.
• Write up the scenario shape, the on-path guarantee, one worked example, and how it maps onto the existing Environment / Case types. Cite the published source.
• Agree the shape in this issue before code lands.

Acceptance criteria:

• A design write-up (comment or short doc) covering: the family, its on-path guarantee, an example scenario, the published citation, and confirmation the scorer is reused unchanged.
• Consensus on the shape, then a follow-up implementation PR (cases + tests).

This one is mentored — happy to pair on the design and the on-path invariant. Good fit if you work on agent safety / indirect prompt injection.