code-review

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The URL is a generic GitHub blob link pointing to an arbitrary repository (unknown owner/repo) which can host arbitrary executable or script content, and combined with instructions to download/execute from it makes it potentially malicious or unsafe.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's workflow (SKILL.md steps such as "View the pull request", step 4 "Read previous PRs", step 3 "Summarize the Change", and the Git history/CLAUDE.md discovery steps) requires using gh to fetch and read GitHub PRs, files, and comments — i.e., user-generated third-party content that the agent interprets and uses to decide actions (posting PR comments), so it can enable indirect prompt injection.