snap-pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The SKILL.md workflow explicitly instructs the agent to "inspect git state" and "inspect current-branch PR" (steps 1 and 4), meaning the agent will fetch and read user-generated PR content from GitHub (a third-party/public source) and may base PR creation/update text and actions on that content, enabling indirect prompt injection.