merge-open-prs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In SKILL.md Phase 1–2, the skill reads GitHub PR metadata for every open PR targeting the trunk via gh pr list --json ... url into /tmp/mop_prs.json and then fetches PR diffs (gh pr diff <number>) for review, so outsider-authored PR content/diffs are ingested at runtime without needing the agent to pre-select a specific authored text item.