code-review-parallel

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text is ingested into the LLM via Step 5: for each PR, the skill fetches the PR diff (gh pr diff / glab mr diff / git diff) and the PR repo’s CLAUDE.md at the PR head ref, then embeds both as the “DIFF” and “CLAUDE.md” sections in the agent prompt (i.e., text authored by external PR contributors and project files from that repo).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches per-PR repository files at runtime (e.g. gh api repos///contents/CLAUDE.md?ref= and glab api "projects/<urlencoded owner/repo>/repository/files/CLAUDE.md/raw?ref=") and injects that CLAUDE.md content (and the fetched diffs from gh pr diff / glab mr diff / az git diff) verbatim into each agent's prompt as the project conventions, so remote repo content directly controls agent instructions.