drupalorg-work-on-issue

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill invokes drupalorg commands (e.g., drupalorg issue:show, issue:get-fork, mr:list, mr:files, mr:diff, mr:status, mr:logs) that fetch issue descriptions, MR diffs, and pipeline logs from Drupal.org/GitLab (public, user-generated sources) and explicitly instructs the agent to read and act on that content as part of its workflow, so untrusted third-party content could influence subsequent actions.