delegate-review

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill explicitly instructs the orchestrator to send PR diffs, absolute repo paths, and git show/grep commands to external "cheap" model services/CLIs (codex/opencode), and to save diffs inside the repo for those sandboxes — a deliberate design that creates a high risk of data exfiltration of source code and secrets to untrusted endpoints.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow gathers a PR diff/body via gh pr view ... --json ... and gh pr diff <n>, then feeds that diff into the finder prompts (LLM context) for multiple external-model runners, so outsider-authored PR text is ingested at runtime.