tk-pr-triage

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/triage.mjs, the required runtime workflow calls ghList/ghObject to fetch GitHub PR/review/comment bodies (repos/${repo}/pulls/.../reviews, .../comments, and issues/${pull.number}/comments), then ingests that free text via collectRows(...).body and uses it in isActionableText/reply-evidence computation.