drive

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's GitHub platform adapter (references/platforms/github.md — "Read State" and the adapter contract) explicitly requires exhausting PR comments from get_comments, get_review_comments, and get_reviews and states that /drive-tick consumes and acts on those untrusted, user-generated inputs (classifying inbox items, amending manifests, invoking /do, committing/pushing, and deciding merge/escallation), so third-party content is read and can materially influence agent actions.