judge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly ingests and acts on user-generated GitHub PRs and commit/PR descriptions (see SCOPE, FAN-OUT, and the GitHub Async Review / --from-pr / @codex review flows in SKILL.md), which are untrusted third-party content the agent reads and uses to drive decisions and follow-up actions.