ci-agents

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime workflow is a CI job/workflow YAML configured to trigger on issue_comment/pull_request_review_comment bodies (e.g., if: contains(github.event.comment.body, '@claude') and contains(github.event.comment.body, '/oc')), meaning outsider-authored free text in comments is ingested at decision time and can flow into the agent’s prompt/context via the action.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The CI examples explicitly run remote installer scripts (curl -fsSL https://claude.ai/install.sh | bash and curl -fsSL https://opencode.ai/install | bash), which fetch and execute remote code at runtime, so these URLs are runtime external dependencies that execute code.