watch-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is ingested at runtime because scripts/watch-pr.sh calls gh pr view and then parses/records reviews[].body and comments[].body from the GitHub PR, which can contain attacker-controlled content before Claude ever “selects a specific item” (the watcher emits event lines based on any new reviews/comments).