upgrading-react-native

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider free text is fetched at runtime from public web sources (e.g., curl -L raw diffs and RELEASES from react-native-community/rn-diff-purge in upgrade-helper-core.md), and that fetched prose/diff content is then ingested into the agent’s LLM context for planning/processing.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly runs curl at runtime to fetch rn-diff-purge artifacts (e.g. https://raw.githubusercontent.com/react-native-community/rn-diff-purge/diffs/diffs/<current_version>..<target_version>.diff and https://raw.githubusercontent.com/react-native-community/rn-diff-purge/master/RELEASES), and those fetched diffs/releases are required and used to drive code changes and merge decisions, so external content directly controls the upgrade actions.