review-pr

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly injects the full PR diff into external model prompts (e.g., $(gh pr diff ...)) so any secrets present in diffs would be passed into and likely echoed by the LLMs, creating a direct secret-exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs running gemini/codex with $(gh pr diff <number> ...) embedded in the prompt, and that PR diff is outsider-authored contributor code/text, which is then read by the LLM at runtime (indirect prompt injection risk).