open-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime the workflow runs gh issue view <issueNumber> --json title,body,labels,author,comments and then “Read the body and every comment,” which ingests outsider-authored issue/comment free text (including prior repro comments) into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clones the target repository at runtime via "git clone https://github.com/.git", and that fetched repo's code is subsequently built/tested/deployed (executed), so remote content controls runtime behavior.