skills/gentleman-programming/gentle-ai/comment-writer/Snyk

comment-writer

Warn

Audited by Snyk on May 10, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (high risk: 0.90). The SKILL.md Commands section explicitly instructs inspecting GitHub pull requests (using "gh pr view") so the agent will fetch and interpret user-generated PR content from an external, public source (GitHub) to decide and craft comments, exposing it to indirect prompt injection.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

May 10, 2026, 05:54 AM

Issues

1