review-code

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In PR mode, the workflow ingests outsider-authored free text from GitHub PR content—specifically gh pr view <number> --json title,body,author,... (PR body/description) and gh api .../pulls/<number>/comments / .../reviews (inline comment and review bodies)—which are then read into the agent’s LLM context for the review.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs fetching repository file contents at runtime via the GitHub API (gh api repos/{owner}/{repo}/contents/{path}?ref={head-branch} | base64 --decode), which would inject external file text into the agent's context and thus directly control prompts/instructions.