gh-issues

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill explicitly fetches and parses untrusted, user-generated content from the public GitHub API (issues and issue bodies in Phase 2, PR bodies/reviews/comments in Phase 6) and the sub-agent prompts in Phase 5/6 require the agent to read and act on that content (make code changes, push branches, create PRs), so external comments/pages can materially influence tool use and actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches issue bodies and PR/review comments at runtime from the GitHub REST API (e.g., https://api.github.com/repos/{SOURCE_REPO}/issues?... and related /pulls and /comments endpoints) and injects that fetched text directly into spawned sub-agent prompts, so remote content can directly control agent instructions.