writing-prs-and-commits

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). TomeVault (tomevault.io) is a third‑party distribution site offering an "install" relay which could deliver executables or installers and is not a well‑known vendor, so treat those links as potentially risky; the GitHub/sourcegraph links point to a reputable project and are not suspicious.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow uses gh pr view --json ... to fetch an existing PR’s title/body (outsider-authored PR content) and then drafts/edits based on that text, so the LLM can ingest that free-form PR body at runtime.