debate-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/review-pr.mjs, the agent fetches PR title/body and spec issues via scripts/lib/forge.mjs (fetchPR and fetchSpec) and then injects PR_TITLE/PR_BODY and SPEC into the implementers’ prompts/briefs, so outsider-authored text from the PR itself and referenced issues is read without any prior selection step.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill clones the target repository at runtime using the URL template https://${target.origin}/${projectPath(target)}.git (scripts/review-pr.mjs), then feeds the checked-out diff and files into the implementer briefs, so externally fetched repo content directly controls the prompts given to the delegate relays.