gh

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). Yes — the skill explicitly fetches and ingests public GitHub content (e.g., scripts/setup_gh.py calls fetch_latest_release against https://api.github.com/repos/cli/cli/releases/latest and downloads assets/checksums, and scripts/github_project_setup.py and scripts/experiment_cleanup.py use PyGithub to read and act on repository issues/labels/milestones), which are untrusted/user-generated and are read/interpreted to determine downloads and workflow actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup_gh.py script performs runtime HTTP requests to https://api.github.com/repos/cli/cli/releases/latest (and the release asset browser_download_url on github.com) to download, verify, extract, and install the gh binary — which results in executing remote code fetched at runtime and is required for the skill to operate.