merge-queue

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested via gh pr list --json ... ,body,... and gh pr view <number> --json commits ..., where the PR body and commit messages are authored by external contributors and are read into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill spawns a "Rebase Agent" at runtime that is instructed to "Read and follow .claude/skills/rebase/SKILL.md" from the checked-out repository (via git worktree/git fetch), meaning remote repo content (the .claude/skills/rebase/SKILL.md file) would be fetched during runtime and directly control agent instructions.