gh-issues

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt instructs agents to read and export GH_TOKEN and even to echo the token prefix and embed $GH_TOKEN into URLs/Authorization headers (including an explicit export with ""), which forces secrets (or parts of them) into generated commands/output and thus risks exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests user-generated GitHub content (issue bodies in Phase 2 and PR bodies/reviews/comments in Phase 6 via the GitHub REST API) and instructs the agent and spawned sub-agents to read and act on that content to decide fixes, pushes, and next actions, which could allow indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime requests to the GitHub REST API (e.g., https://api.github.com/repos/{SOURCE_REPO}/issues?... and related endpoints) to fetch issue bodies and review comments which are then injected verbatim into spawned sub-agent prompts, meaning external content from those URLs can directly control agent instructions.