issue-refine-loop

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). SKILL.md Phase 2 reads the target GitHub issue title/body/comments (and labels/hierarchy) via the bound read_issue operation, which directly ingests outsider-authored free text into the LLM workflow at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly loads references/epic-structure.md before Phase 2 and that file states it is "read directly for this skill" from https://github.com/lousy-agents/coach/issues/97, indicating the agent may fetch that external GitHub issue at runtime and use its content to drive prompts/instructions.