scheduling-doc-sync

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In doc-audit.yml, the audit job’s model step uses anthropics/claude-code-action and runs a free-form prompt while reading repository documentation (via the engine) from the current repo checkout, which is outsider-authored content the attacker can influence.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflows clone and use https://github.com/aj604/toolshed.git at runtime (e.g., git clone --branch "v${VERSION}" https://github.com/aj604/toolshed.git …), and the cloned repository supplies plugins and scripts that are executed or loaded into model steps (controlling prompts and running code), so this runtime fetch directly controls agent prompts / executes code.