dep-pr-cleanup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill reads GitHub pull request bodies, titles, and diffs via gh, which can contain outsider-authored text from untrusted external contributors and bots.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill's documented workflow collects open GitHub PRs from dependency bots (Dependabot, Renovate), analyzes version overlap via helper scripts, and—upon user confirmation—closes obsolete PRs using the GitHub CLI (gh pr close --delete-branch) and deletes their branches. Because it executes direct operational instructions to close remote pull requests and alter repository state, it represents a direct financial/operational modification route. However, this direct route is protected by mandatory independent access validation and authentication: execution requires authenticated gh credentials with write access verified via gh auth status (where missing auth halts execution and prompts gh auth login), as well as explicit, interactive user confirmation (AskUserQuestion / Step 6) before any closing action occurs.