review-deep

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text is ingested via runtime GitHub API/CLI fetches of PR/issue bodies and comments (e.g., gh pr view ... --json ... body,comments,reviews and gh api graphql ... reviewThreads ... comments { body author { login } }, plus gh issue view ... --json ... body,comments), which are then assembled into the LLM context for Steps 5–7.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes GitHub API calls at runtime (via gh pr view, gh api graphql, gh issue view, gh api "repos/.../pulls/.../comments") which fetch PR/issue/review thread content from endpoints such as https://api.github.com/graphql and https://api.github.com/repos///pulls//comments and then injects that fetched content into the agent's context/prompts, meeting the criteria for a runtime external dependency that can control prompts.