orchestrate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow can read outsider-authored GitHub issue/PR text when the invocation includes autopilot plus an implementation spec GitHub issue URL, since it calls gh issue view ... --json ... body and then parses the resulting body content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The GitHub issue URL pattern ^https://github\.com/([^/]+)/([^/]+)/issues/([0-9]+)$ is parsed at runtime and fetched via gh (see the bash preamble), and the fetched issue body is used to determine integration branch, ticket membership, and routing—i.e., external content directly controls agent decisions.