gh-issues

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.95). The prompt requires the agent to read and export GH_TOKEN from configs and to embed it into commands/URLs (e.g., auth headers, remote URLs) and even to echo parts of the token, which forces handling and potential verbatim exposure of a secret.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill fetches outsider-authored free text from GitHub at runtime—specifically PR/issue review bodies and comments (e.g., GET /repos/{SOURCE_REPO}/pulls/{pr_number}/reviews, /comments, /issues/{pr_number}/comments, and /pulls/{pr_number} body) in Phase 6, then passes that text into sub-agent prompts for analysis/fixing, creating an indirect prompt-injection risk.