gh-review-resolve

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required workflow runs the bundled helper (scripts/gh-review-comments) which uses gh api graphql to fetch PR review thread comments.body from GitHub (outsider-authored PR review comments) and then passes that readable text into the agent via the helper’s JSON output.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The bundled helper script calls GitHub via gh api/graphql and constructs/fetches the PR at URLs like https://github.com///pull/ at runtime to retrieve review comment bodies, which the skill ingests and uses to determine edits and resolutions—meaning remote comment content can directly control the agent's actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill mainly performs repo-level changes (commits/pushes) which are expected, but it explicitly instructs the agent to "escalate permission for networked gh commands when sandboxing blocks them," i.e. to bypass sandbox/network restrictions — an instruction to escalate/evade security controls — so it poses a nontrivial risk to the host environment.