issue-todo

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The GitHub issue/api/Atlassian URLs are standard tracker/vendor endpoints, but the raw.githubusercontent.com template URLs are potentially risky because raw.githubusercontent.com serves arbitrary raw files (including scripts or binaries) from user-controlled repos and can be used to distribute malware if the origin is untrusted or unverified.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). issue-todo의 required runtime workflow에서 node <skill>/scripts/issue-todo.mjs sync 가 트래커를 통해 GitHub/Jira의 열린·닫힌 이슈 body 및 comments(외부 사용자가 작성 가능한 자유 텍스트)를 LLM이 파싱/추출(의존 depends on #N 정규식, <!-- issue-graph-v2-decision ... --> 결정 코멘트 JSON 파싱)하는 경로가 존재합니다.