triaging-visual-review-runs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill instructs the agent to read PR comments, issue logs, and visual review artifacts which may contain outsider-authored text and feedback.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 0.70). The skill describes an agent workflow for inspecting and triaging visual regression review runs via PostHog MCP tools. Actions include listing runs, checking flakiness, approving, tolerating, quarantining, and finalizing (committing baselines). The finalize action is a direct financial operation / settlement equivalent ("Commit the approved baseline to the PR branch and green the GitHub visual-review check. This ships the change.") or more broadly, the skill exposes direct operations such as finalize-create, approve-create, and tolerate-create. However, no qualifying independent access control (such as service-enforced authentication/authorization checking credentials on these payment or write routes independent of the agent) is documented for these write operations; the text only discusses human confirmation gates rather than technical independent service access validation enforcing the route. Therefore, it is a direct operation without established qualifying control.