gh-activity-summary

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md and activity-report.sh invoke the GitHub CLI (gh search) to fetch commits, pull requests, issues, and comments from GitHub (user-generated, public third-party content) and explicitly suggests piping the generated report into an LLM for summarization, meaning that untrusted external text is read and can materially influence the model's outputs/actions.