auto-continue-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill reads the PR body via gh pr view {prNumber} --json body to extract the Tracking plan: line and then opens $PLAN_PATH (a file authored by the PR branch/outsider), so outsider-authored free text from the PR/workflow plan can be ingested into the agent’s LLM context during parsing and summary generation.