pr-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Outsider-authored free text is ingested via scripts/fetch_pr_metadata.sh → gh pr view ... --json ... body,comments,author (PR body/comments written by the PR author/others), which the workflow then uses as LLM context for the review.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The setup script performs a runtime git clone from "https://github.com/${REPO_OWNER}/${REPO_NAME}.git", which fetches arbitrary repository code that the skill then reads to build review context—i.e., remote content is fetched at runtime and directly controls the agent's prompts/context.