github-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is described as calling Composio/Rube MCP GitHub tools (e.g., listing issues/PRs, getting PR/workflow details, searching code), which at runtime will ingest outsider-authored free text from GitHub (issue/PR bodies, comments, file contents) into the agent’s LLM context via the tool responses.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the agent to use Rube MCP at runtime (e.g., "Add https://rube.app/mcp as an MCP server" and "Always call RUBE_SEARCH_TOOLS first"), meaning https://rube.app/mcp is a required runtime endpoint that provides tool schemas which can directly control the agent's prompts and behavior.