pr-triage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested when the workflow fetches GitHub PR review thread comment bodies via GraphQL (pullRequest.reviewThreads.nodes[].comments[].body), where author.login can be a non-operating-user (bots/humans) and that body is then used in the agent’s LLM context for triage.