watch-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text from the PR’s CI failure logs and Greptile review/comment bodies (from GitHub APIs for runs/reviews/comments) is fetched at runtime and would be ingested into the agent context via the script outputs and the “Read the failure logs” / “Fetch the review body / comments” steps.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime gh api calls (e.g., repos//pulls/<PR_NUMBER>/reviews and .../comments, i.e. https://api.github.com/repos//pulls/<PR_NUMBER>/reviews and .../comments) to fetch review bodies and line-level comments which are then used to decide and drive code-change actions, so external content directly controls the agent's behavior.