github-pr-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored free text is ingested via runtime GitHub API calls that fetch PR review comment bodies and CodeRabbit review bodies (gh api repos/$REPO/pulls/$PR/comments... .body and gh api repos/$REPO/pulls/$PR/reviews... .body, plus pulls/$PR/reviews/$REVIEW_ID/comments... .body), where the comment text is authored by other users/bots.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches PR review bodies and review-attached comments at runtime via the GitHub REST API (e.g. https://api.github.com/repos///pulls//reviews and https://api.github.com/repos///pulls//reviews/<review_id>/comments) and then uses CodeRabbit "Prompt for AI Agents" blocks from those fetched bodies as primary context to drive the agent's prompts, so external content fetched at runtime can directly control agent instructions.