council-review

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly fetches GitHub pull-request content at runtime (e.g., PR URLs like https://github.com/.../pull/... via the "gh pr view" fetch) and injects that remote PR diff/description directly into the advisor prompts, so external content can control the agent's prompts.