review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly fetches and ingests arbitrary GitHub PR content (e.g., via "gh pr view", "gh pr diff", "gh api contents", "gh api git/trees" in Phase 1/2) — public/user-generated repository text (PR bodies, files, comments) is treated as grounding for reviewer decisions and for automated actions (posting/resolving review threads), so untrusted third‑party content could indirectly inject instructions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill fetches GitHub PRs and repo files at runtime (e.g. the PR URL https://github.com/owner/repo/pull/123 and GitHub API content endpoints like repos///contents/.claude/review-suppressions.yml?ref=), and it injects that fetched diff/file content (including .claude/review-suppressions.yml and repo exports) directly into reviewer prompts, so remote repo content can directly control agent behavior.