github-code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). For PR interactions, the skill fetches PR body/metadata and changed files via GitHub API (curl .../pulls/$PR_NUMBER and /pulls/$PR_NUMBER/files), and then uses that content to generate review text that is sent back into the agent/LLM context—this is outsider-authored free text (PR description and file contents) flowing into the LLM at runtime.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill makes runtime calls to GitHub (e.g., https://api.github.com/repos/$OWNER/$REPO/pulls/$PR_NUMBER and https://api.github.com/repos/$OWNER/$REPO/pulls/$PR_NUMBER/files) and fetches remote branches via git fetch origin pull/123/head (using the repository remote URL), which pulls external PR metadata and repository code that the skill then ingests for review and may execute (e.g., running tests), so remote content can directly influence prompts or execute code.