gh-address-comments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's SKILL.md and scripts/fetch_comments.py explicitly fetch PR conversation comments and review threads from GitHub using gh api graphql / python3 scripts/fetch_comments.py and instruct the agent to summarize and act on those user-generated comment bodies, so untrusted third-party text can influence decisions and tool actions.