pr

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs the GitHub API fetch command gh api -H "Accept: application/vnd.github.raw+json" repos/<owner>/.github/contents/.github/PULL_REQUEST_TEMPLATE.md at runtime to retrieve a PR template whose contents are then used to structure and populate the PR text, so external content directly controls the agent's prompts.