panel-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's PR mode (see prompts/review-pr.md and SKILL.md) explicitly requires panelists to run gh pr view, gh pr diff, and optional gh api calls to fetch GitHub PR metadata, diffs, and review/comments — i.e., untrusted, user-generated third‑party content that the agents must read and that directly drives findings, verification steps, and subsequent actions, creating an indirect prompt‑injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs GitHub/remote fetches at runtime (e.g., gh pr diff against the PR URL like https://github.com///pull/ and git fetch of the PR head repo URL such as /.git), and those fetched PR diffs and repo objects are explicitly consumed to build panelist prompts and to materialize worktrees that may run tests/install deps — remote content therefore directly controls the agents' prompt/context and can cause execution of fetched code.