review-as

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). At runtime, the required scripts gather step fetches outsider-authored GitHub review/comment text (from other users’ PR bodies, inline comments, and issue comments) via the gh api --paginate ... --jq ... calls in scripts/gather-review-history.ts, writes it into a readable JSON history file, and the workflow then instructs the agent to read and distill those body fields into the LLM context (prompt injection risk).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's troubleshooting guidance instructs running a remote install script that fetches and executes code (curl -fsSL https://bun.sh/install | bash), and bun is required to run the gather step, so this URL is a runtime remote-code-install dependency.