injective-core-detect-changes

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow fetches GitHub release notes and a changelog for NEXT_TAG (outsider-authored public web content), summarizes them into NOTES_FROM_RELEASE, and passes that free-form text into the invoked devrel-detect-breaking-changes agent, so the LLM context is indirectly fed outsider text at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent to fetch and analyze repository/release content at git@github.com:InjectiveFoundation/injective-core.git and specific GitHub release/changelog URLs (e.g. https://github.com/InjectiveLabs/injective-core/releases/tag/v1.20.0) at runtime, which will inject external content into the agent's analysis context and thus directly control its prompts/behavior.