skills/okisdev/ai-reference/ship-pr/Snyk

ship-pr

Warn

Audited by Snyk on Aug 25, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (medium risk: 0.30). In the required runtime workflow, ship-pr monitors and reads GitHub PR data including reviewThreads and review/check state via gh pr view/gh pr checks/gh api .../pulls/<n>/reviews, so outsider-authored PR comment/thread text (from the PR’s submitters/reviewers) is ingested at runtime without needing to actively fetch a specific item.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Aug 25, 2026, 03:24 AM

Issues

1

Security Audit — snyk — ship-pr