review-summary

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's Process steps explicitly fetch PR commits via GitHub API (e.g., "gh api repos///pulls//commits") and read the original author's code with "git show :" and the current code via the Read tool, meaning the agent ingests user-generated, third-party PR content from GitHub and uses it to decide and generate review actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill invokes GitHub API endpoints at runtime (for example, https://api.github.com/repos///pulls//commits) and reads PR file contents (via gh api / git show) which are injected into the agent's context and therefore directly control its prompts, so external content is a required runtime dependency.