agent-loop-autoreview

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow ingests outsider-authored free text from GitHub PR review bodies/comments (e.g., gh api .../pulls/{pr}/reviews and /comments filtered to bot users), and that body text is then used for extraction and fix generation in the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill uses GitHub API calls at runtime (e.g., gh api repos/{owner}/{repo}/pulls/{pr}/reviews and gh api repos/{owner}/{repo}/pulls/{pr}/comments) to fetch bot review comments that include "🤖 Prompt for AI Agents" which are then used to drive the agent's fixes, so external content directly controls agent prompts.