pm-thread-to-spec

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). ClickUp v3 chat URLs are fetched at runtime by scripts/fetch_clickup_thread.py, which calls the ClickUp API and renders the parent/replies content into Markdown (_md) that is then ingested into the agent’s LLM context—this is outsider-authored free text from third-party users in the thread.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill includes a runtime fetcher (scripts/fetch_clickup_thread.py) that calls ClickUp APIs (e.g. https://api.clickup.com/api/v3/workspaces/{team_id}/chat/messages/{msg_id}/replies and https://api.clickup.com/api/v2/team) to pull thread content which is then injected into agent prompts, and the SKILL.md also instructs using gh issue view <url> --json ... to fetch GitHub issue content at runtime — both are clear runtime external fetches whose returned content directly controls the agent's prompts.