parley

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The templated GitHub release download URL is potentially high-risk because it directly fetches release assets (executables) from an arbitrary repo which could be attacker-controlled; the other URLs (https://rustup.rs and the GitHub API endpoint) are standard, benign services.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md, Parley’s required workflow runs parley-fetch to fetch unresolved review threads via GraphQL and then uses those thread contents to drive the fix/reply steps, so outsider-authored PR review thread text is ingested at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). scripts/ensure-bin.sh performs runtime network fetches to https://api.github.com/repos/${repo}/releases/latest and downloads the release asset from https://github.com/${repo}/releases/download/v${ver#v}/${asset}, then installs and executes that binary (the skill calls this script to obtain SCRUTINY_BIN), so remote content can directly provide executable code run by the agent.