gh-pr-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/fetch_comments.py, the collector calls gh api graphql to read PR conversation comments, review bodies, and inline review thread comment body fields from the associated GitHub pull request, which can contain outsider-submitted free text.