github-repo-browser-read-only

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow for this skill can ingest outsider-authored free text from GitHub repository contents (e.g., get_file/get_readme returning UTF-8 decoded README/file text, or download_repo_to_storage archives that downstream steps may extract into prose) into the agent’s LLM context, enabling indirect prompt injection via malicious README/source text.