review-assurance-case

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill explicitly enables broad provider CLI permissions (COPILOT_ALLOW_ALL and CLI flags like --allow-all-tools / --allow-all-paths) which weakens security boundaries by granting the provider extensive tool/path access and exposing those env overrides to subprocesses.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path review_assurance_case.py → _load_case() (reads user-supplied --file/--json) → _review_full_async() → run_provider_async() sends the resulting case text ({case_content}) as a free-text prompt to the LLM for all review steps.