sentry-code-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md:69-103 describes fetching GitHub PR review comments (including the body field) authored by the Sentry bot and then parsing/extracting the “AI Agent Prompt” and analysis text from that outsider-provided free-form comment body into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches PR comments at runtime using the GitHub API command "gh api repos/{owner}/{repo}/pulls/<PR_NUMBER>/comments" (and/or the PR URL via WebFetch), and those comment bodies explicitly include an "🤖 Prompt for AI Agent" section whose content is parsed and injected into the agent workflow, so remote content directly controls agent instructions.