rick-review

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill injects raw diff slices and verbatim pre-scan / deny-list content into agent prompts and then writes agent reports that cite or include those lines, so any secrets present in the diffs would be handled and likely emitted verbatim by the LLM.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 3.5(b), the orchestrator reads untrusted PR body text via gh pr view --json body and extracts sections verbatim into $PR_INTENT, which is then used at Step 7.7 for the intent cross-check.