morning-pr-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). During each nightly “tick” this skill runs press/bin/collect.mjs, which calls gh pr diff, gh pr list, and gh pr diff --name-only to read GitHub PR titles/metadata/diffs and descriptions (outsider-authored text), then the LLM uses that collected facts to write the brief/manifest and edition.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt explicitly instructs running a backgrounded Bash tool with "dangerouslyDisableSandbox: true" (bypassing the agent sandbox), which asks the agent to disable security protections and run unsandboxed processes on the machine.