full-code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—runtime DIFF and CHANGED_FILES are sourced from the target PR/branch (diff + PR metadata via git diff / gh pr view / gh pr diff in SKILL.md), and are embedded as plain-text into reviewer and synthesis agent prompts in scripts/full-code-review.js (the LLM reads untrusted code/PR text).