pr-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text can enter the LLM context via runtime-fetched GitHub PR content (e.g., gh pr view ... --json title,body,...,files,... and gh pr diff ...), where title/body and diff hunks include arbitrary text authored by the PR author/others.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill fetches repo files at runtime (notably .ai-factory/skill-context/pr-review/SKILL.md and other RULES/CHECKLIST files) via GitHub API calls such as https://api.github.com/repos///contents/.ai-factory/skill-context/pr-review/SKILL.md?ref=, and that fetched content is used to override review behavior and control the agent's prompts — a required runtime dependency.