drizzle-migration-conflict

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Most links are official docs and GitHub discussions (low risk), but three GitHub Gist URLs point to personal scripts that can contain executable/destructive code and thus are higher-risk to download and run without review.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow runs the helper script scripts/check_drizzle_migrations.py, which reads and parses _journal.json/snapshot.json/.sql files from the target repository and then prints their contents (e.g., parse errors and structural findings) as readable text into the agent’s context—these files are outsider-authored when they come from other developers/PRs.