load-pr-review

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly packages and sends unredacted repository diffs to an external "Codex" verdict service and states those diffs are "never recorded in audit log", which constitutes an intentional, high-risk data-exfiltration / audit-evasion pattern despite otherwise normal review automation behavior.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Step 1→Step 2, the skill fetches GitHub PR review thread comment body from the target PR via scripts/run-skill.sh ... fetch --pr ... --repo ... (GraphQL/REST), then passes that outsider-authored reviewer text into per-thread /seek-verdict calls.