pre-changelog

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads outsider-authored free text from an open GitHub release PR by calling gh api repos/MoonshotAI/kimi-code/pulls/<RELEASE>/files and extracting the patch for apps/kimi-code/CHANGELOG.md, which is author-submitted content before merge.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill runs a GitHub API fetch at runtime (gh api repos/MoonshotAI/kimi-code/pulls//files) to retrieve the PR changelog diff which is then injected/processed to drive the agent's preview output, so external content directly controls the agent's behavior.