pr

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches and reads untrusted, user-generated content from GitHub (e.g., via gh pr view, gh api repos/{owner}/{repo}/issues//comments, gh api repos/{owner}/{repo}/pulls//comments and by git fetching the PR worktree and reading changed files), and it uses that discussion, inline suggestions, and file contents to drive analysis, decisions, and automated actions (drafting/posting reviews and merge operations), which could allow indirect prompt-injection from third-party content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill fetches PR code at runtime from the repository remote (e.g., via "git fetch origin pull//head" and worktree creation) and then runs project tests/linters (e.g., npm test, pytest), so externally fetched repository content is executed and can directly influence the agent's analysis and prompts.