review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md Phase 1 explicitly instructs the agent to run gh pr view to fetch a PR's title, body, state, and changed files from GitHub (user-generated, third‑party content), and Phases 2–4 require the agent to read and interpret those diffs to determine risk, select templates, and consult subagents—so external PR content can materially influence analysis and subsequent actions.