pr-review-canvas

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). Outsider-authored PR content (e.g., PR title/body, file patches, and PR review comments written by the GitHub PR author/others) is fetched at runtime via gh api repos/{owner}/{repo}/pulls/{number}... / /files / /comments, then embedded as readable HTML and diff text into template.html (including the pr-diffs-json <script type="application/json"> payload) and rendered by renderer.js into the agent’s LLM-visible context.