lov-gh-tidy

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow ingests outsider-authored GitHub issue/PR and label metadata by running gh issue list / gh pr list / gh label list and then summarizes their titles/comments/labels before asking the user, so a repo user can submit poison via those items that the workflow will read.