setup-routines

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The routines explicitly clone repos and fetch/read GitHub user-generated content (PR bodies, review threads, comments, issues, and merged-PR file lists) as part of required workflows (see routines/pr-review.md, pr-feedback-resolve.md, issue-triage.md, docs-drift.md and GH API/gh commands) so untrusted third-party content is ingested and can influence actions like edits, comments, labels, and PR/issue creation.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The routine explicitly clones the project's GitHub repository at runtime (e.g., git@github.com:OWNER/REPO.git or https://github.com/OWNER/REPO.git), and then loads .claude/ hooks and CLAUDE.md from that repo which directly control routine prompts and can execute hook scripts, so the fetched repo content directly controls the agent and is a required runtime dependency.