github-worktree

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Skill.md 在 Step 2/A 通过 GitHub MCP（user-github）读取用户提供的 issue_number 的 issue 标题/labels/type（issue_read），而这些字段会被后续用于生成分支名与工作流决策，因此存在被外部作者内容“注入”到运行时可读文本的路径。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs git remote set-url and git fetch against https://github.com/TencentBlueKing/bk-ci.git at runtime (SKILL.md:151), and the fetched repository content is later used to create a worktree and run gradlew tasks, which can execute code from that remote repository.