flaggems-pr-review-flagos

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). PR mode fetches outsider-authored free text (changed file patches/full contents and commit messages from GitHub) via scripts/fetch_pr_diff.py, which then feeds that text into scripts/review_operator.py and ultimately into the LLM context through the skill’s “model uses script output findings” flow.