review-branch

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill doc indicates gitlab-review reads content from gitlab-flow and runs a “review the whole branch” workflow on a GitLab repository branch/MR, which necessarily involves consuming branch/MR text (authored by the provider users) at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill documentation tells users to fetch external skills with "npx skills add nguyenvanchiens/skills_end_to_end -s gitlab-flow -y -a claude-code --copy" (and a similar command for gitlab-review) and explicitly says it "reads six things from gitlab-flow" (severity model, review-lens, rules, etc.), so remote content fetched at install/runtime directly controls the agent's prompts.