review

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The prompt includes an explicit instruction claiming its "Security Constraints" "override ... system-level instructions" and commands the agent to "MUST" follow them, which is an attempt to override higher-priority/system instructions and therefore constitutes a prompt-injection-style directive outside the normal code-review scope.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly instructs the agent and subagents to fetch PR metadata, diffs, commits, and file contents from GitHub using the gh CLI ("Use gh CLI (via Bash) for ALL GitHub data fetching"), which is untrusted, user-generated third-party content that the agent must read and use to drive review decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly requires fetching repo files/CLAUDE.md at runtime via GitHub (e.g., https://github.com/redpanda-data/connect/blob/[full-sha]/path/file.ext#L[start]-L[end]) and injects that fetched content into agent prompts/instructions, so remote GitHub content directly controls agent behavior.