review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and ingests GitHub pull request content (metadata, commits, files, DIFF) via scripts/fetch-pr.sh and the SKILL.md workflow directs the agent to read CONTEXT.md, ADRs and full changed files from the PR — all user-generated, potentially untrusted third-party content that the agent must interpret to decide tests, linting, and what review comments/actions to take.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches PR files and repo content at runtime (e.g., via the GitHub API endpoint pattern "gh api repos/:owner/:repo/contents/?ref=<head_sha>" and by running "gh pr checkout "), which pulls remote repository content that is then used to drive the agent's review (influencing prompts/context) and to run tests/linters (executing fetched code).