code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md explicitly instructs the agent to fetch and read GitHub PR diffs, full source files, and the PR description/comments (e.g., "gh pr diff <PR_NUMBER>" and "Now read the PR description, linked issue, and comments" in Steps 1 and 4), which are untrusted, user-generated third-party content that the agent must interpret and that can materially influence review actions and posting; this creates a clear avenue for indirect prompt injection.