pr-review-comments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly instructs the agent to fetch and load GitHub pull request review comments via the prc CLI (e.g., "This skill fetches GitHub pull request review comments using the prc CLI tool" and the Example Workflow), which pulls untrusted, user-generated content from public/private PRs that the agent will read and use to drive review actions—creating a clear avenue for indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill uses the prc CLI to fetch GitHub pull request review comments at runtime (e.g., https://github.com/owner/repo/pull/123), and those externally-fetched comments are injected as model context that directly control the agent's prompts/instructions.