code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow ingests PR metadata/diff/file lists via mcp_github_pull_request_read (e.g., get_diff, get_files, and get for description), where the PR author’s description and changed-file contents are outsider-authored free text that can be included in the agent’s LLM context.