cross-model-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow’s “PR mode” fetches GitHub PR content (title/body and diffs) via gh pr view ... --json title,body,... and gh pr diff, and the agent then feeds that outsider-authored PR text/diff into the LLM context for both review passes, creating an indirect prompt-injection channel via arbitrary PR body/diff content.