batch-bug-shepherd

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). Yes: Phase 0/1/1.5/2 ingest outsider-authored GitHub issue/PR text (e.g., gh issue list ... --json ... body and gh pr list ... --json ... title/author/body plus “inspect each linked PR on the issue”), which is then passed as free-form issue_body/issue_title/issue_body inputs into LLM subagents (triage and apm-ceo strategic-alignment), creating an indirect prompt-injection path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly probes/fetches host-repo content at runtime via GitHub API calls (e.g., gh api repos/<owner>/<repo>/contents/.apm/agents/apm-ceo.agent.md and gh api repos/<owner>/<repo>/contents/PRINCIPLES.md), and that fetched content (the apm‑ceo persona and PRINCIPLES.md) is loaded and used to drive the strategic-alignment subagent's prompts/decisions, so this is a runtime external dependency that directly controls agent behavior.