gh-address-copilot-comments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required workflow runs scripts/fetch_copilot_threads.py, which uses GitHub GraphQL via gh api graphql to fetch PR review thread comments.body (free-form text authored by other GitHub users) and then passes that JSON into the agent’s LLM context for triage.