pull-request

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime path for comment, resolve, and reply uses ./scripts/gh-review-comments (via gh api graphql) to fetch and ingest outsider-authored GitHub review thread bodies/comments at runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly instructs the agent to "Escalate network permissions for gh when sandboxing blocks GitHub API calls," which directs bypassing sandbox/network restrictions and could lead to compromising the host's security posture.