pr-code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's required workflow explicitly fetches and ingests user-generated PR content from GitHub (e.g., "gh pr view " and "gh api repos/$OWNER_REPO/contents/?ref=$COMMIT_SHA") and uses that content to drive analysis and to decide/post review actions, so untrusted third-party PR text could indirectly inject instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill issues runtime GitHub API calls that fetch repository files (e.g., gh api repos/$OWNER_REPO/contents/<path>?ref=$COMMIT_SHA --jq '.content' | base64 -d), and those fetched file contents are injected into the review context passed to the agent, so remote content can directly influence prompts/outputs.