review-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text from the PR itself (e.g., PR body/comments and linked issue text) is fetched at runtime via gh pr view/gh issue view and then used to build the toolkit’s review context that the LLM agents consume.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill fetches PR code and metadata from the remote repo "nrwl/nx" at runtime (e.g., gh pr view --repo nrwl/nx and git ... fetch origin pull/...) and then instructs the pr-review-toolkit agents to read the worktree/.review-context, so externally-fetched repository content directly drives agent prompts and outputs (repo: nrwl/nx).