gh-address-comments

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md + scripts/fetch_comments.py, the required runtime workflow fetches and ingests outsider-authored PR text (GitHub issue/PR comments, review bodies, and inline review thread comment bodies) via gh api graphql in fetch_all() and main() for the current branch’s associated PR.