issue-fixer

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The prompt explicitly instructs the agent to hide AI involvement (e.g., "Never add AI identification" and "All contributions must appear as human-written"), which is a deceptive instruction outside the core purpose of fixing issues and submitting PRs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In Phase 1/2, the workflow runs gh search issues ... --json ... body (and later “Read the issue body and comments thoroughly”), so outsider-authored GitHub issue body/comments are ingested as free text into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill uses gh/git operations against GitHub (e.g., cloning/forking "https://github.com/$REPO.git" and concrete examples like "https://github.com/htop-dev/htop" and "https://github.com/htop-dev/htop/issues/1991") at runtime, then reads repo files and PR content to drive PR titles/bodies and runs the project's test/build commands—so remote GitHub-hosted content is fetched during execution and can both control agent prompts/conventions and cause execution of remote code.