gh-issues

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow “load context” uses gh issue view ... --json comments --jq ... .comments[] | select(.body | contains("AI-CONTEXT")) | .body, which ingests the body text of GitHub issue comments authored by other people (outsider) into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches GitHub issue comments at runtime (e.g., via "gh issue view ... --json comments" and the API path repos/:owner/:repo/issues/comments/COMMENT_ID — e.g. https://api.github.com/repos/:owner/:repo/issues/comments/COMMENT_ID) and injects AI-CONTEXT comment content into the agent session, which directly controls prompts.