review-pr

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill explicitly instructs the agent to embed hidden HTML markers and to avoid any AI disclosure so automated comments appear as human (and to gate behavior via those hidden tokens), which are deceptive, hidden instructions outside the stated review functionality.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow reads outsider-authored free text from GitHub PR description, linked-PR parsing, and full PR history (comments/review threads/commit messages), which includes external user inputs authored by non-trusted parties.