looper-pr-takeover

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). At runtime in Mode A, the skill uses gh api graphql to fetch unresolved PR review thread comment bodies from GitHub (reviewThreads...comments{... body ...}) and then includes that fetched free text in the agent’s working context to decide how to reply/fix/resolve—this is outsider-authored content (other reviewers’ comments).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly tells an agent at runtime to fetch and "read" the remote instruction files (which would control the agent's behavior), e.g. https://raw.githubusercontent.com/nexu-io/looper/main/mirrors/mirrors-looper/looper-pr-takeover/SKILL.md (and the related https://raw.githubusercontent.com/nexu-io/looper/main/mirrors/mirrors-looper/looper-pr-takeover/references/github-commands.md), so these URLs are runtime external dependencies that directly control prompts.