workflow-retro

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads pull request bodies, reviews, review threads, and comments via gh api (scripts/collect-prs.mjs), which exposes the agent to outsider-authored free text from GitHub PR interactions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The instruction executes npx -y skills@latest add hcaiano/skills --skill <name> -g -a claude-code codex cursor grok -y, which retrieves external executable skill/plugin material from an ordinary community npm package and repository at runtime via an npm registry transport, constituting an unofficial operational dependency.