local-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md workflow explicitly fetches and checks out arbitrary GitHub branches (e.g., "git fetch USERNAME" and "git worktree add ... USERNAME/BRANCHNAME"), which pulls untrusted, user-generated repository code from third-party GitHub accounts that the agent will set up and run, so external content could influence actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill adds and fetches from a remote git URL (git@github.com:USERNAME/humanlayer) at runtime and then copies .claude settings from the worktree and runs setup commands (make -C WORKTREE setup and humanlayer thoughts init), so fetched repository content can both supply agent prompt/settings and introduce/execute code.