git-pr-sync-check

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/check-pr-sync.sh, the workflow reads PR state by calling gh pr view "$BRANCH" --repo "$REMOTE_URL" --json ..., which ingests free-text fields from GitHub PR metadata/content authored by outsiders (e.g., via API response fields such as reviewDecision/statusCheckRollup).