triage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the “Gather” step, the workflow uses gh issue list, gh issue view <n> --json comments ... | .body, and gh run view <id> --log-failed to ingest issue/PR titles, comment bodies, and CI log text authored by outsiders.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill runtime uses the GitHub API to fetch the maintainer's past comments and distill .triage/voice.md (which directly shapes agent prompts/voice), e.g. gh api "/search/issues?q=commenter:@me+repo:bitbonsai/mcpvault", so external content influences agent behavior.