pr-review-triage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly pulls PR review comments from GitHub via the gh CLI (e.g., "gh pr view ... --json reviews,reviewThreads,comments"), which are user-generated/untrusted third-party content that the agent is required to read, classify, and use to decide actions and draft responses, so those comments could inject instructions that influence behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.85). This skill invokes the GitHub API at runtime (eg. via "gh pr view" / "gh api repos/{owner}/{repo}/pulls/{number}/comments" — equivalent to https://api.github.com/repos/{owner}/{repo}/pulls/{number}/comments) to fetch PR review comments which are then injected into the agent's prompt/context, so external content can directly control instructions.