skills/shipshitdev/skills/pr-comments/Snyk

pr-comments

Warn

Audited by Snyk on Jun 20, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (high risk: 0.95). The skill’s Phase 2 fetches PR comment/review text from GitHub (gh pr view ... --json comments,reviews and gh api .../pulls/$PR/comments plus GraphQL reviewThreads{...comments{nodes{path body ...}}}), which is outsider-authored free text from other users’ PR review threads and conversations.

Issues (1)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Jun 20, 2026, 10:37 AM

Issues

1

Security Audit — snyk — pr-comments