github

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The SKILL.md explicitly instructs using the gh CLI (e.g., gh pr checks, gh run view, gh api repos/owner/repo/pulls/...) to fetch PRs, workflow logs, and issue/PR metadata from GitHub—public, user-generated content that the agent would read and could materially influence follow-up actions, so it can enable indirect prompt injection.