ci-cd-and-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s runtime workflow explicitly instructs copying CI failure output and feeding it to the agent (“Copy the failure output → Feed it to the agent”), and that failure output is generated by CI tooling/logs that can include arbitrary text from the repo’s PR (outsider-authored code/tests) and/or external services, which the LLM then ingests as free-form error text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The CI workflows call remote GitHub Actions (e.g. https://github.com/actions/checkout, https://github.com/actions/setup-node, https://github.com/actions/upload-artifact), pull a Docker image (postgres:16), and run npx commands (e.g. npx vercel, npx playwright) which fetch and execute remote code at CI runtime, so external content is executed by the pipeline.