pr-shepherd

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads PR details, status checks, and review thread comments from GitHub pull requests, which contain outsider-authored text.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill operates an automated loop for reviewing, fixing, and merging pull requests on GitHub (including executing merges like gh pr merge at levels L3-L5). This constitutes a direct financial/resource-related deployment action or operational execution without independent access control provisions described in the document.