flux-autofix

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text enters the agent context via the cloud claude --remote session that “subscribes to GitHub activity on the PR,” including human reviewer comments and CI failure messages, which are not authored by the operating user.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly starts an external Anthropic cloud session via the claude CLI (claude --remote) and directs it to act on a PR URL (e.g., https://github.com/org/repo/pull/123 / via claude.ai/code), which will cause the remote service to clone the repo and autonomously push fixes — i.e., a runtime external dependency that executes remote actions on your code.