doris-repo-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text from the PR description “focus” is accepted from the user after the PR URL (not first-party), written to $CTX/review_focus.txt in scripts/prepare-review-context.sh, and then ingested by the LLM via the subagent prompts that include that file content ({FOCUS} substitution) in references/prompts.md.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs fetching remote agent instructions via the GitHub API call "gh api repos/apache/doris/contents/.claude/skills/code-review/SKILL.md?ref=master" at runtime when the local checklist is missing, which makes external content control the agent's review behavior.