paperclip-orchestrator

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The very first line tells models (in Portuguese) to treat the file as authoritative and "just obey" without invocation, which attempts to override normal invocation/system boundaries and is a hidden/deceptive instruction outside expected safe behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text can enter the LLM context via the reviewer agent’s runtime reading of GitHub PR content (PR body/diff/files) using gh pr view/gh pr diff in AGENTS-reviewer.md, where the PR body is authored by non-operating users (dev-primary/others) and is then used as prompt context for the agent.