pr-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该 skill 在 Step 0 读取 GitHub PR 的外部作者文本来源（PR diff、PR body、issue 关联信息，以及 PR 的 comments/reviews）并在 Step 2/3 里把这些自由文本与代码进行核验：gh pr view <n> --json ... / gh pr view <n> --comments / gh api .../pulls/<n>/comments / gh api .../pulls/<n>/reviews。

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill includes explicit instructions to install a system package via apt (apt install gh -y) — which modifies system state and requires elevated privileges — and also instructs the agent to create worktrees and push commits to PR branches, so it directs actions that change the host environment and could require privilege escalation.