setup-routines

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The docs enable automatic execution of repository-provided hooks and scripts in cloud-hosted routine sessions, automatic pickup of updated hooks, and use of external connectors/tokens (and the ability to commit/push), creating high-risk supply‑chain, remote‑execution and data‑exfiltration avenues if abused.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In routines/pr-review.md, the routine reads PR title/body (outsider-authored text) via gh pr view --json ... body when triggered by pull_request.opened/synchronize, and then ingests that free text at runtime to drive the review.