yeet

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and parses public, user-generated GitHub content (e.g., gh issue view in references/comment-issue.md, gh api repos/{owner}/{repo}/contents/.github/ISSUE_TEMPLATE in references/create-issue.md and issue-claude-code.md, and gh search discussions / discussion category queries in create-discussion.md), and the agent is required to read and act on that untrusted content to choose templates, generate bodies/comments, select categories, and decide follow-up actions—so third-party content can materially influence behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill issues gh api calls at runtime to fetch repository form templates (e.g., gh api repos/{owner}/{repo}/contents/.github/ISSUE_TEMPLATE/{template_name} — corresponding to https://api.github.com/repos/{owner}/{repo}/contents/.github/ISSUE_TEMPLATE/{template_name}), and those fetched template files are parsed and injected into the generated issue/discussion/PR bodies, so remote content can directly control prompts/instructions.