gh-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill's workflows explicitly fetch and parse public, user-generated GitHub content (e.g., "Bulk Operations" showing gh issue list --json number --jq '.[].number' | xargs -I {} gh issue close {} and the "gh api" sections) and then programmatically act on those results, so untrusted third-party content from GitHub can influence tool use and next actions.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill includes explicit installation commands that use sudo and write to system locations (e.g., /usr/share/keyrings, /etc/apt/sources.list.d) which instruct the agent to perform privileged modifications to the host system.