golang-continuous-integration

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The workflows and review instructions explicitly run "npx skills add https://github.com/samber/cc-skills-golang" and tell the agent to "pick" and read SKILL.md files from the installed skills (copilot-review-instructions.md and multiple claude workflow steps), which causes the agent to fetch and interpret public GitHub-hosted skill files (untrusted third-party content) that can change its review behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The GitHub Actions workflows run "npx skills add https://github.com/samber/cc-skills-golang" at runtime, which fetches remote skill files that are then loaded and used to shape the AI review prompts/instructions (so the external repo directly controls agent behavior).