ce-babysit-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 2/5, the runtime uses scripts/pr-snapshot to fetch GitHub PR review threads and top-level comment/review bodies (outsider-authored text) and passes them to delegates (ce-resolve-pr-feedback / ce-debug) for judgment/fixing, creating an indirect prompt-injection surface.