self-healing-ci

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via runtime ingestion of CI logs and PR diff (e.g., failing check logs, PR-authored content) that the skill “reads” to produce diagnosis/fix; these are not authored by the operating user and may contain prompt-injection strings.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The workflow invokes the external GitHub Action githubnext/gh-aw at runtime (uses: githubnext/gh-aw@v0 — https://github.com/githubnext/gh-aw), which fetches and executes remote code to run the self-healing agent and thereby directly controls agent execution.