review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). In step 3 the workflow fetches PR content (diff, files list, metadata, and existing comments) from GitHub via gh pr view/gh pr diff/gh api, and those responses include free-form text like PR title/body and comment bodies authored by others, which the agent would ingest into its LLM context for review generation.