to-qa

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill's workflow explicitly reads completed child work from configured issue trackers — including GitHub, GitLab, or custom trackers as noted in "Supported Paths" and the "Workflow" and "MCP Usage" sections — meaning it ingests user-generated issue/commit/comment content that the agent interprets to create QA checks, which could allow indirect prompt injection from untrusted public tracker data.