sprint-dev

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes—at runtime the skill loads outsider-authored free text from GitHub Issues (via gh issue list ... --json number,title,body,... and then parses body), and that issue body/spec content is included in the sub-agent prompts (Phase 2B), creating an indirect prompt-injection path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill fetches GitHub issue/PR content at runtime (e.g. PR/issue links like https://github.com/...) via gh/regex matches and explicitly includes issue/spec text in sub-agent prompts, so remote GitHub content directly controls agent instructions.