prd-to-html

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill may resolve a PRD from an outsider-authored GitHub issue by running gh issue view <n> --json title,body --jq '.title, .body', then parses the returned title/body (free text) and injects it into the generated HTML/LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill runtime can call out to GitHub to fetch issue text (via the gh CLI flow "gh issue view " / a tracker URL), and that fetched issue body is injected into the agent's parsing/generation flow to control the produced HTML, so it is a runtime external dependency that can control prompts.