address-review-bots

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). At runtime, scripts/review-bot-snapshot.mjs fetches outsider-controlled GitHub free text from PR comments/reviews/issues comments via ghJson pagination (/repos/:owner/:repo/pulls/:pull_number/comments, /pulls/:pull_number/reviews, /issues/:pull_number/comments) and includes each bot comment body for downstream LLM classification/fix decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's runtime script calls GitHub API endpoints (e.g., /repos/${repo.owner}/${repo.name}/pulls/${pull.number}/comments) to fetch bot comment bodies which are then injected into the agent's workflow to classify and act on review-bot instructions, so external content directly controls agent behavior.