review-anvil-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required workflow reads GitHub Pull Request discussions, review threads, and issue comments, allowing an outsider to submit untrusted text into the ingested PR feedback stream.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill posts pull request reviews and approvals to GitHub via the gh CLI and gh api (SKILL.md:167 notes that an APPROVE decision submits a real GitHub approval from the authenticated gh account, counting toward branch protection). This is a direct financial/operational action (specifically, authorizing and submitting official PR approvals and reviews that impact code merging and repository state), but it is gated by authenticated gh service credentials (SKILL.md:15 states gh preflight checks auth). Therefore, independent access control is present.