root-cause

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required workflow uses gh issue view ... --json ... body,comments, which ingests the outsider-authored GitHub issue body and comments (public/authenticated GitHub content not authored by the operating user) as readable text into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill runs a runtime GitHub query (gh issue view --repo {owner}/{repo} {issueId}, which calls the GitHub API at e.g. https://api.github.com/repos/{owner}/{repo}/issues/{issueId}) to fetch the issue body/comments and then instructs the agent to "skim" and follow reproduction steps, so remote content directly influences the agent's prompts and is a required dependency.