github-pr-reviewer

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The automation deliberately exposes platform secrets to the AI conversation (and gives the agent terminal/file access) and then posts the agent's raw output as a GitHub comment, creating a direct path for credential theft or data exfiltration and enabling remote command execution via the agent tools.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). The required runtime workflow fetches outsider-authored GitHub PR content (e.g., PR description/body and label event details) via GitHub REST API and injects it as free text into the LLM context through create_conversation(..., initial_message={"content":[{"text": initial_message}]}) where initial_message is built by _build_review_prompt() from pr["body"] and label_event fields.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The automation builds and sends a review prompt that explicitly instructs the agent to clone the repository at https://github.com/{REPO}.git (included in the prompt), which causes the agent runtime to fetch remote repository code as part of its review execution.