gh-stack

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). GitHub issue/PR text is indirectly ingested when the workflow runs gh stack view --json (and subsequent gh pr view ... --json / gh stack sync) which refreshes PR state from GitHub, including PR titles/bodies and review/check metadata.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill instructs (at runtime) to install the extension with "gh extension install github/gh-stack", which fetches and installs remote code from the GitHub repository https://github.com/github/gh-stack and therefore can execute remote code locally.