pr-fix

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow reads the selected PR's description, diff, checks, and failed-job logs via gh (SKILL.md step 3), and bot PR titles, descriptions, and changelogs are authored by outsiders, which is a GitHub PR reading path and so is medium.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill's operational dependency is Drupal patches fetched from git.drupalcode.org and www.drupal.org and applied to the project as code, with the patch chosen dynamically from upstream issue-queue content. Those patches are community-contributed rather than first-party published, and the dynamic selection makes the source weak, so the tier is high.