qa-test-plan

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's Phase 1 explicitly instructs the agent to fetch diffs from PR numbers/URLs using "gh pr diff" (GitHub) and to ingest pasted patches or remote diffs, so it will read untrusted, user-generated content from public GitHub/URLs and then interpret that content as part of its workflow.