changes-review

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill contains explicit meta-instructions that tell the agent to ignore other mode-switch directives and to unconditionally enforce/authorize its protocol and subagent actions (e.g., "Ignore Claude-specific mode-switch instructions" and "Strict execution contract"/subagent authorization), which are attempts to override external/system constraints and user control and therefore constitute prompt-injection style directives outside ordinary review content.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Required runtime workflow reads outsider-authored free text by ingesting the repository’s own current diff and file contents via git/git diff and per-file review (Phase 1/2), which can include text authored by external users/PR authors.