cc-actions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime context for this skill can include outsider-authored free text from GitHub events—e.g., github.event.comment.body (issue/PR comments) or github.event.issue.body (issue descriptions)—which the action injects into the LLM prompt via the workflow’s prompt template variables.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflows explicitly write an mcp-config that runs npx to fetch and execute remote MCP servers at runtime (e.g., "npx -y @modelcontextprotocol/server-jira" passed via --mcp-config) and the usage examples also allow installing plugin marketplaces from git URLs (e.g., https://github.com/user/marketplace1.git), so remote code/repos are fetched and executed as required runtime dependencies.