review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s runtime path fetches PR diffs via gh pr diff {pr} / git diff {branch} / reading a diff file, and those diffs (authored by non-operating users) are ingested into the spawned agents’ LLM context via the dossier and review prompts—an outsider free-text injection surface.