code-review-playbook

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md’s runtime flow, PR description/comments and other user-provided prose are treated as untrusted and the agent “Extract[s] facts only from prose,” but every emitted finding must be grounded in file:line from the provided diff, so outsider free text is ingested only as untrusted prose without controlling grounded review outputs.