github-agent-actions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow explicitly fetches outsider-authored free text from GitHub at runtime via the event payload it uses in the generated prompt (e.g., github.event.pull_request.title, github.event.issue.body, github.event.comment.body, etc.), which can be authored by non-trusted users in PRs/issues/comments.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs runtime fetches from the anthropics/claude-code-action repo (e.g., "gh api repos/anthropics/claude-code-action/contents/action.yml --jq '.content' | base64 -d") and uses those fetched files as the authoritative source to determine action inputs/events and to construct prompts, so this is a runtime external dependency that directly controls prompts.