review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow requires running gh pr diff <url> (SKILL.md:67), loading PR body metadata, and consuming pull request reviews and comments via GraphQL (phase1-timeline-state.md:8), all of which ingest outsider-authored free text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The documented operation reviews GitHub pull requests and automatically submits reviews, approvals, and change requests via the GitHub CLI (gh api / review endpoints). This qualifies as an indirect financial operation (submitting billable usage / formal deliverables / pull request actions) or direct settlement authorization for a repository workflow. However, access control relies on the execution layer's authenticated gh session and API tokens (GitHub CLI authentication), establishing independent service-level authentication checks for API requests.