dependabot-review

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The skill explicitly instructs the agent to omit any "posted by / generated by" attribution and make PR comments "read as if written by the user," which is a deceptive instruction to impersonate the user and is outside normal, transparent behavior expectations for an automated tool.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). In audit mode, the workflow uses gh pr list to discover Dependabot PRs and then gh pr view/gh pr diff to ingest outsider-authored PR body/diff/changelog-related text into the agent’s LLM context, which is indirect prompt-injection risk from public GitHub PR content authored by the Dependabot bot (an outsider).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly fetches changelogs at runtime from external sources (e.g., https://github.com//releases and registry pages like https://www.npmjs.com/package/, https://rubygems.org/gems/, https://pypi.org/project/) and injects that remote content into the review workflow/model context, so those URLs can directly influence agent prompts and outputs.