claude-code-security-review-action

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime path is the GitHub Action anthropics/claude-code-security-review@main analyzing the checked-out PR code (via actions/checkout), which includes outsider-authored free text such as PR diff/commit messages and changed file contents from external contributors; that text is then ingested into the action’s LLM context for security review.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill contains runtime fetches of remote code that control agent behavior — e.g., the workflow pulls the action code via "uses: anthropics/claude-code-security-review@main" (downloads/executes remote repo), the local setup runs "git clone https://github.com/anthropics/claude-code-security-review.git" and executes its Python scripts, and the slash-command customization runs "curl -o .claude/commands/security-review.md https://raw.githubusercontent.com/anthropics/claude-code-security-review/main/.claude/commands/security-review.md", all of which fetch remote content that can define prompts or execute code.