review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly says "If a PR number is given: Fetch the full PR diff. Fetch PR metadata (title, description, base/head refs, comments, changed files)," which means the agent ingests untrusted, user-generated content from public PRs/issues on GitHub and uses it to drive review decisions, creating a clear risk of indirect prompt injection.