kata-review-pull-requests

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's required workflow (SKILL.md) calls gh pr view and reads the PR/diff into diff_content which is then inlined into Task prompts sent to subagents, so untrusted user-generated PR content from GitHub (a third-party source) would be ingested and can influence agent actions.