changelog

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). SKILL.md Phase 1 explicitly instructs the agent to "check for merged PRs using gh pr list" and "read the PR diff and description" (and to extract commit/PR messages), which ingests user-generated GitHub PR content that the agent must interpret and which can influence categorization and output, so untrusted third-party text could affect behavior.