ship

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Contains a direct GitHub release asset hosted under an unfamiliar account (time-attack) which can be used to distribute binaries/releases outside the main project, plus a nonstandard domain (garryslist.org) that resembles a typosquat — both are common vectors for distributing malware and warrant caution.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow reads outsider-authored text from GitHub PR and issue comments via references/artifacts/review/greptile-triage.md (fetching .body/html_url from repos/$REPO/pulls/$PR_NUMBER/comments and repos/$REPO/issues/$PR_NUMBER/comments).