panel-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). In PR mode (--pr), each panelist subprocess reads outsider-authored free text from GitHub at runtime via gh pr view / gh pr diff / gh api .../comments inside prompts/review-pr.md, and that fetched PR title/body/diff/comments are ingested into the panelist LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The script performs a runtime git fetch from the PR head repository URL (pr_head_url — e.g. https://github.com//.git) to materialize per-panelist worktrees, and those fetched repo contents can be executed by panelists (tests, installs, build steps), so this is a runtime external dependency that can execute code.